CVE-2026-63342: Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hatchetto a version that resolves this vulnerability.Fixed in 0.91.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Hatchet user can exploit it if they obtain the UUID of a durable task belonging to another tenant. The attack is network-accessible, but requires low-privilege authenticated access and knowledge of a target task UUID.
What information could be exposed?
The affected endpoint can disclose another tenant's durable task event log. This may include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information.
Which deployments are affected and what is the fix?
Hatchet versions prior to 0.91.1 are affected. Upgrade to version 0.91.1, which adds the missing tenant authorization protection for this endpoint.
Is this a cross-tenant issue by default?
The vulnerable endpoint does not require the target tenant as a parent resource, so tenant isolation is not enforced for requests to the affected durable-task event-log endpoint. Exposure still depends on an attacker obtaining a durable task UUID from another tenant.