Live › vulnerability › CVE-2026-63342
Go to dashboardHatchet's durable task event log endpoint does not check that a requested task belongs to the caller's tenant. An authenticated user who learns another tenant's durable task UUID can read that task's event log, which can include task names, workflow identifiers, user messages, wait conditions, branching logic and timing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/hatchet-dev/hatchet | go | < 0.91.1 | 0.91.1 |
grep hatchet-dev/hatchet go.mod and confirm the version is below 0.91.1
If running multiple tenants, confirm which tenants can create accounts on the instance
Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63342")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.