---
id: "CVE-2026-63342"
kind: "vulnerability"
aliases: ["CVE-2026-63342", "GHSA-g26x-m427-f48f", "GO-2026-6567"]
title: "Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet"
severity: "medium"
cvss: 6.3
epss: 0.00314
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/hatchet-dev/hatchet", "fixed": ["0.91.1"], "affected": "< 0.91.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "hatchet", "multi-tenant", "runtime", "self-hosted"]
not_affected_if: ["single-tenant-deployment", "version-0.91.1-or-later"]
published_at: "2026-09-21T16:17:10+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:13+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6567", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-63342", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63342", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet

Hatchet's durable task event log endpoint does not check that a requested task belongs to the caller's tenant. An authenticated user who learns another tenant's durable task UUID can read that task's event log, which can include task names, workflow identifiers, user messages, wait conditions, branching logic and timing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/hatchet-dev/hatchet affected < 0.91.1 fixed 0.91.1

## How to check

grep hatchet-dev/hatchet go.mod and confirm the version is below 0.91.1
If running multiple tenants, confirm which tenants can create accounts on the instance

## Fix

Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6567
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-63342
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63342

## From the sources

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_