GHSA-g26x-m427-f48f: Medium severity go/github.com/hatchet-dev/hatchet vulnerability
Summary
The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (listDurableEventLog) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.
Impact This CVE requires the attacker to successfully guess the target UUID. Any authenticated Hatchet user can read durable task event logs from any other tenant, exposing: - Task display names and workflow identifiers - User messages (may contain sensitive business data) - Wait conditions and branching logic - Timing information
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hatchet-dev/hatchetto a version that resolves this vulnerability.Fixed in 0.91.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Hatchet user can exploit it. The attacker must successfully guess the UUID of a durable task belonging to another tenant.
What information could be exposed?
An attacker can read durable task event logs from other tenants. These logs can expose task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information.
Is an unauthenticated attacker affected by this issue?
No. Exploitation requires an authenticated Hatchet user account.