~ / search / GHSA-g26x-m427-f48f

GHSA-g26x-m427-f48f

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-63342

Packages

EcosystemPackageAffectedFixed in
Go github.com/hatchet-dev/hatchet < 0.91.1 0.91.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary The `GET /api/v1/stable/durable-tasks/{durable-task}` endpoint (`listDurableEventLog`) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant. ### Impact This CVE requires the attacker to successfully guess the target UUID. Any authenticated Hatchet user can read durable task event logs from any other tenant, exposing: - Task display names and workflow identifiers - User messages (may contain sensitive business data) - Wait conditions and branching logic - Timing information

References

External links from the advisory. They lead to third-party sites.