CVE-2026-88978
Received Received - Intake

Information Disclosure in Hatchet Workflow Engine

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-88978
EUVD
EUVD-2026-83980

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hatchet hatchet to 0.106.1 (exc)
hatchet-dev hatchet to 0.106.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Hatchet, a platform for managing background tasks and workflows. It allows an authenticated tenant worker to retrieve another tenant's durable event-log records by providing a known durable-task UUID. The issue occurs because the WorkerStatus gRPC polling path does not filter queries by tenant ID when resolving these UUIDs. Exploitation is unlikely due to UUIDv4 randomness, and single-tenant deployments are unaffected.

Detection Guidance

Check Hatchet version with 'hatchet version' or inspect logs for unauthorized access attempts to durable event records. Monitor gRPC calls to WorkerStatus service for unexpected tenant data exposure.

Impact Analysis

If you use a multi-tenant Hatchet deployment, an attacker with access to one tenant could potentially access another tenant's event logs by guessing a valid UUID. This could lead to unauthorized data exposure. The impact is limited by the difficulty of guessing UUIDv4 values and the lack of user interaction required for exploitation.

Compliance Impact

This vulnerability could violate data isolation requirements in GDPR and HIPAA by allowing unauthorized cross-tenant data access. Multi-tenant deployments must ensure tenant data is strictly segregated to comply with these regulations. The issue increases the risk of non-compliance due to potential unauthorized data exposure.

Mitigation Strategies

Upgrade to Hatchet version 0.106.1 or later. For self-hosted instances, ensure tenant isolation is properly configured. Review access logs for suspicious activity related to durable event queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88978. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart