---
id: "CVE-2026-88978"
kind: "vulnerability"
aliases: ["CVE-2026-88978", "GHSA-992g-9cr3-vm5x", "GO-2026-6560"]
title: "Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet"
severity: "medium"
cvss: 4.3
epss: 0.00281
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/hatchet-dev/hatchet", "fixed": ["0.106.1"], "affected": "< 0.106.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "hatchet", "multi-tenant", "package", "self-hosted"]
not_affected_if: ["single-tenant", "version-0.106.1-or-later"]
published_at: "2026-09-21T16:17:26+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:10+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6560", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-88978", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88978", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Hatchet's WorkerStatus gRPC polling path looks up durable event-log records by caller-supplied durable task, node, and branch IDs without filtering by tenant. An authenticated tenant worker that knows another tenant's durable-task UUID can read that tenant's matching event-log records.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/hatchet-dev/hatchet affected < 0.106.1 fixed 0.106.1

## How to check

Check the Hatchet version in go.mod or the deployed image; versions before 0.106.1 are affected.
Single-tenant deployments are described as unaffected in practice.

## Fix

Upgrade github.com/hatchet-dev/hatchet to 0.106.1 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6560
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-88978
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88978

## From the sources

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_