Is CVE-2026-61687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61687 being exploited in the wild.

How severe is CVE-2026-61687?

High severity, with a CVSS score of 7.1, published 21 September 2026.

Which products and versions are affected?

github.com/hatchet-dev/hatchet (Go) SEMVER:introduced=0; hatchet (Go) SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.

Is there a fix for CVE-2026-61687?

Yes. hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61687 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61687?

Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61687: Hatchet OAuth state CSRF via empty-state collision

Q: Is there a fix for CVE-2026-61687?

Yes. hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61687 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61687?

Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61687 · Severity: high · CVSS 7.1 · Published 2026-09-21

Hatchet is a task orchestration and scheduling platform that supports OAuth-based login via Google, GitHub, and Slack. An unauthenticated attacker can exploit a flaw in session state validation to bind a victim's authenticated session to an attacker-controlled OAuth account, effectively taking over the victim's account without needing to compromise their password or MFA.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-61687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61687 being exploited in the wild.
How severe is CVE-2026-61687?: High severity, with a CVSS score of 7.1, published 21 September 2026.
Which products and versions are affected?: github.com/hatchet-dev/hatchet (Go) SEMVER:introduced=0; hatchet (Go) SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.
Is there a fix for CVE-2026-61687?: Yes. hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61687 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61687?: Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hatchet (Go): upgrade to 0.91.1 or later
```
go get hatchet@v0.91.1
```

Technical details

This vulnerability is a session fixation and OAuth state CSRF vulnerability (CWE-287, CWE-352, CWE-384) in the ValidateOAuthState function. The vulnerable code clears the session `oauth_state_<integration>` variable to an empty string `""` after a successful OAuth callback, rather than removing the key entirely. Later, during state validation, the code accepts an empty `?state=` parameter as valid, allowing an unauthenticated attacker to craft a malicious OAuth callback URL with `state=` that matches the empty session value. If a victim with an existing authenticated session visits this link, the attacker's OAuth identity binds to the victim's session cookie. The attack requires user interaction (victim must click a link) and affects deployments with Google, GitHub, or Slack OAuth enabled. Patch is available in version 0.91.1 and later.

Affected products

Hatchet Hatchet < 0.91.1

Identifiers

CVE-2026-61687
GHSA-phg3-3g28-wq9v
GO-2026-6535

Timeline

2026-09-21: disclosed: Published to GitHub Advisory Database
2026-09-21: patched: Fix available in version 0.91.1

References

https://api.github.com/users/manop55555

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.