https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:14:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63342 <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant&#39;s durable task UUID to read that task&#39;s event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.</p> <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant&#39;s durable task UUID to read that task&#39;s event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63342 https://db.gcve.eu/vuln/ghsa-g26x-m427-f48f <p><strong>Affected:</strong> Go: github.com/hatchet-dev/hatchet</p> <p>### Summary</p> <p>The `GET /api/v1/stable/durable-tasks/{durable-task}` endpoint (`listDurableEventLog`) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.</p> <p>### Impact This CVE requires the attacker to successfully guess the target UUID. Any authenticated Hatchet user can read durable task event logs from any other tenant, exposing: - Task display names and workflow identifiers - User messages (may contain sensitive business data) - Wait conditions and branching logic - Timing information</p> <p><strong>Affected:</strong> Go: github.com/hatchet-dev/hatchet</p> <p>### Summary</p> <p>The `GET /api/v1/stable/durable-tasks/{durable-task}` endpoint (`listDurableEventLog`) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.</p> <p>### Impact This CVE requires the attacker to successfully guess the target UUID. Any authenticated Hatchet user can read durable task event logs from any other tenant, exposing: - Task display names and workflow identifiers - User messages (may contain sensitive business data) - Wait conditions and branching logic - Timing information</p> https://db.gcve.eu/vuln/ghsa-g26x-m427-f48f