Is CVE-2026-42572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42572 being exploited in the wild.

How severe is CVE-2026-42572?

Medium severity, with a CVSS score of 5.3, published 14 May 2026.

Which products and versions are affected?

github.com/hatchet-dev/hatchet (Go) <= 0.83.38, SEMVER:introduced=0,fixed=0.83.39; Hatchet < 0.83.39, < v0.83.39, <= 0.83.38.

Is there a fix for CVE-2026-42572?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.83.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42572 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42572?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42572: Hatchet incorrect authorization in task metadata endpoint

Q: Is there a fix for CVE-2026-42572?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.83.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42572 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42572?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42572 · Severity: medium · CVSS 5.3 · Published 2026-05-14

Hatchet is an orchestration platform used to manage background tasks and AI workflows. A security flaw allowed authenticated users to bypass authorization checks and view task metadata belonging to other organizations (tenants) on the same system. While sensitive task inputs were not exposed, an attacker could see workflow details and internal metadata, potentially leading to the disclosure of user identifiers or correlation tokens.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-42572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42572 being exploited in the wild.
How severe is CVE-2026-42572?: Medium severity, with a CVSS score of 5.3, published 14 May 2026.
Which products and versions are affected?: github.com/hatchet-dev/hatchet (Go) <= 0.83.38, SEMVER:introduced=0,fixed=0.83.39; Hatchet < 0.83.39, < v0.83.39, <= 0.83.38.
Is there a fix for CVE-2026-42572?: Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.83.39 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42572 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42572?: Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hatchet-dev/hatchet (Go): upgrade to 0.83.39 or later
```
go get github.com/hatchet-dev/hatchet@v0.83.39
```

Technical details

A missing authorization directive on the 'GET /api/v1/stable/dags/tasks' endpoint caused Hatchet's tenant-membership check to be bypassed. The 'listTasksByDAGIds' operation failed to declare the 'x-resources: ["tenant"]' attribute in its OpenAPI definition, preventing the middleware from populating the request context with tenant information and triggering the necessary authorization logic. An attacker with an account on the same instance could provide a victim's tenant UUID and DAG UUID to retrieve task metadata, including workflow IDs, status, and 'additional_metadata' JSON fields. The vulnerability is fixed in version 0.83.39 by adding explicit authorization checks to the handler.

Affected products

Hatchet Hatchet < 0.83.39

Identifiers

CVE-2026-42572
GHSA-55gc-6fmc-fpx9
GO-2026-5134

Timeline

2026-04-23: disclosed: Reported to Hatchet
2026-04-23: patched: Patch deployed to Hatchet Cloud and released as v0.83.39
2026-05-14: advisory: CVE published

References

https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.