https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 11:36:48 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-88978 <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant&#39;s durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.</p> <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant&#39;s durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-88978 https://db.gcve.eu/vuln/ghsa-992g-9cr3-vm5x <p><strong>Affected:</strong> Go: github.com/hatchet-dev/hatchet</p> <p># Cross-tenant disclosure risk on `DurableTask` bidi RPC</p> <p>This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task&#39;s event log, and returning them to the caller via the `handleWorkerStatus` polling path.</p> <p># Impact</p> <p>This advisory requires an attacker to successfully guess a durable task&#39;s external uuid belonging to another tenant. External ids are generated uuid v4s (`uuid.New()` in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.</p> <p>### Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:</p> <p>* Hatchet Cloud (multi-tenant SaaS) * Self-hosted Hatchet with multiple internal teams / business units sharing one instance * Any deployment where a single tenant&#39;s API token can be obtained by an attacker</p> <p>Single-tenant self-hosted deployments are unaffected in practice (the &#34;victim&#34; and &#34;attacker&#34; tenants would be the same).</p> <p><strong>Affected:</strong> Go: github.com/hatchet-dev/hatchet</p> <p># Cross-tenant disclosure risk on `DurableTask` bidi RPC</p> <p>This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task&#39;s event log, and returning them to the caller via the `handleWorkerStatus` polling path.</p> <p># Impact</p> <p>This advisory requires an attacker to successfully guess a durable task&#39;s external uuid belonging to another tenant. External ids are generated uuid v4s (`uuid.New()` in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.</p> <p>### Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:</p> <p>* Hatchet Cloud (multi-tenant SaaS) * Self-hosted Hatchet with multiple internal teams / business units sharing one instance * Any deployment where a single tenant&#39;s API token can be obtained by an attacker</p> <p>Single-tenant self-hosted deployments are unaffected in practice (the &#34;victim&#34; and &#34;attacker&#34; tenants would be the same).</p> https://db.gcve.eu/vuln/ghsa-992g-9cr3-vm5x