Live › vulnerability › CVE-2026-88978
Go to dashboardHatchet's WorkerStatus gRPC polling path looks up durable event-log records by caller-supplied durable task, node, and branch IDs without filtering by tenant. An authenticated tenant worker that knows another tenant's durable-task UUID can read that tenant's matching event-log records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/hatchet-dev/hatchet | go | < 0.106.1 | 0.106.1 |
0.106.1 are affectedUpgrade github.com/hatchet-dev/hatchet to 0.106.1 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-88978")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.