{"id":"CVE-2026-63342","kind":"vulnerability","aliases":["CVE-2026-63342","GHSA-g26x-m427-f48f","GO-2026-6567"],"related":[],"title":"Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.","summary":"Hatchet's durable task event log endpoint does not check that a requested task belongs to the caller's tenant. An authenticated user who learns another tenant's durable task UUID can read that task's event log, which can include task names, workflow identifiers, user messages, wait conditions, branching logic and timing.","severity":"medium","cvss":6.3,"epss":0.00314,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/hatchet-dev/hatchet","fixed":["0.91.1"],"affected":"< 0.91.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","hatchet","multi-tenant","runtime","self-hosted"],"not_affected_if":["single-tenant-deployment","version-0.91.1-or-later"],"how_to_check":"grep hatchet-dev/hatchet go.mod and confirm the version is below 0.91.1\nIf running multiple tenants, confirm which tenants can create accounts on the instance","fix":"Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later","status":"open","published_at":"2026-09-21T16:17:10+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:46:13+00:00","updated_at":"2026-10-23T21:46:13+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T21:46:13Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later\nunknown","reach":"unknown","impact":"medium","summary":"Hatchet's durable task event log endpoint does not check that a requested task belongs to the caller's tenant. An authenticated user who learns another tenant's durable task UUID can read that task's event log, which can include task names, workflow identifiers, user messages, wait conditions, branching logic and timing.","category":"runtime","who_cares":["go","hatchet","multi-tenant","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Authenticated user reads other tenants' durable task event logs","analyst_note":"","how_to_check":"grep hatchet-dev/hatchet go.mod and confirm the version is below 0.91.1\nIf running multiple tenants, confirm which tenants can create accounts on the instance","needs_analyst":false,"not_affected_if":["single-tenant-deployment","version-0.91.1-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000823,"input_tokens":3063,"output_tokens":1033,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A,30A '-63342':20A,31A '-6567':28A '/api/v1/stable/durable-tasks':122C '/hatchet-dev/hatchet':17A,34A '/openapi/paths/v1/workflow-runs/workflow_run.yaml':118C '0.91.1':114C,182C 'agent':106C 'ai':105C 'allow':139C 'anoth':69B,145C 'api':116C 'api-contract':115C 'authent':65B,141C 'author':12A 'background':103C 'belong':58B 'branch':93B,171C 'caller':61B 'check':13A,53B 'condit':92B,170C 'contract':117C 'cross':3A 'cross-ten':2A 'cve':18A,29A 'data':159C 'defin':119C 'disclos':158C 'disclosur':9A 'display':163C 'durabl':5A,46B,72B,108C,124C,148C 'durable-task':123C 'endpoint':50B,126C 'event':7A,48B,80B,156C 'f48f':25A 'fix':179C 'g26x':23A 'get':121C 'ghsa':22A 'ghsa-g26x-m427-f48f':21A 'github.com':16A,33A 'github.com/hatchet-dev/hatchet':15A,32A 'go':26A,35B 'hatchet':1A,36B,44B,97C 'host':43B 'identifi':88B,166C 'implement':127C 'includ':84B,161C 'inform':175C 'issu':177C 'learn':68B 'listdurableeventlog':129C 'log':8A,49B,81B,157C 'logic':94B,172C 'm427':24A 'messag':90B,168C 'miss':11A 'multi':38B 'multi-ten':37B 'name':86B,164C 'obtain':144C 'orchestr':102C 'parent':137C 'platform':100C 'prior':112C 'read':76B,152C 'request':56B 'requir':131C 'resourc':138C 'runtim':40B 'scale':111C 'self':42B 'self-host':41B 'target':133C 'task':6A,47B,57B,73B,78B,85B,104C,125C,149C,154C,162C 'tenant':4A,39B,63B,70B,134C,146C 'time':96B,174C 'user':66B,89B,142C,167C 'uuid':74B,150C 'version':181C 'via':10A 'wait':91B,169C 'without':130C 'workflow':87B,109C,165C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-21T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6567","url":"https://pkg.go.dev/vuln/GO-2026-6567","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-63342","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63342","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-63342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63342","severity":null,"published_at":"2026-09-21T16:17:10+00:00","modified_at":"2026-09-29T15:17:27+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}