CVE-2026-63342
Received Received - Intake

Information Disclosure in Hatchet Workflow Runs

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-63342
EUVD
EUVD-2026-83977

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hatchet-dev hatchet to 0.91.1 (exc)
hatchet-dev hatchet 0.91.1
hatchet-dev hatchet 0.91.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Hatchet (versions before 0.91.1) involves a missing authorization check in the GET /api/v1/stable/durable-tasks/{durable-task} endpoint. An authenticated user could read another tenant's durable task event logs by providing a valid UUID, exposing sensitive workflow and task details.

Detection Guidance

Check if your Hatchet instance is running a vulnerable version (<= 0.86.29) by running: hatchet version. Inspect API logs for unauthorized access attempts to /api/v1/stable/durable-tasks/{durable-task} endpoints. Monitor for unusual data exfiltration patterns in durable task event logs.

Impact Analysis

An attacker could access confidential data like task names, workflow IDs, user messages, wait conditions, branching logic, and timing information from other tenants. This requires guessing a valid UUID but could lead to data leaks or workflow analysis.

Compliance Impact

This vulnerability likely violates data protection regulations (GDPR, HIPAA) by enabling unauthorized access to sensitive user and workflow data across tenants, risking non-compliance with confidentiality and access control requirements.

Mitigation Strategies

Upgrade Hatchet to version 0.91.2 or later immediately. Verify tenant-based authorization is enforced by testing access to cross-tenant durable task logs. Review and restrict API permissions to prevent unauthorized UUID guessing attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart