CVE-2026-108755

Hatchet prior to version 0.106.1 lacks a tenant filter in the WorkerStatus gRPC polling path in pkg/repository/durable_events.go. An authenticated tenant worker, knowing another tenant's durable-task UUID, can retrieve matching durable event-log records, leading to cross-tenant data leakage.

Hatchet prior to 0.95.3 stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload.

Hatchet prior to version 0.91.1 lacks a tenant check in the API endpoint GET /api/v1/stable/durable-tasks/{durable-task} defined in api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml. An authenticated user who obtains another tenant's durable task UUID can read that task's event log, including task display names, workflow identifiers, user messages, wait conditions, and branching logic.

In Hatchet prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity.

Hatchet before version 0.91.1 has an SSRF vulnerability in the SNS UnsubscribeConfirmation handler. An authenticated tenant can replace the UnsubscribeURL field in a valid AWS-signed message with an internal URL, allowing server-side requests to EC2 Instance Metadata Service, internal services, and internal HTTP APIs. This may expose IAM credentials or network-accessible data and functionality.

Hatchet from 0.40.0 until 0.91.1 does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher.