Executive brief
Hatchet is a workflow orchestration and task management platform. An authentication bypass flaw in the durable task event log API endpoint allows any authenticated user to access event logs and sensitive business data from other tenants by guessing UUIDs, potentially exposing workflow details, user messages, and timing information across organizational boundaries.
Technical details
The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (listDurableEventLog) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from tenants other than their own. This is an Incorrect Authorization (CWE-863) vulnerability requiring low privileges and network access. An attacker must successfully guess the target durable task UUID, after which they can retrieve sensitive event logs containing task display names, workflow identifiers, user messages (potentially containing sensitive business data), wait conditions, branching logic, and timing information. The vulnerability affects versions prior to 0.91.1, which introduced the authorization check; patching to 0.91.1 or later resolves the issue.
Affected products
- Hatchet Hatchet < 0.91.1
Timeline
- 2026-09-22: disclosed: Published on GitHub Advisory Database
- 2026-09-22: patched: Fixed in version 0.91.1
- 2026-06-30: advisory: Initially published on GitHub repository security advisory