CVE-2026-63342: Hatchet authorization bypass in durable task event log endpoint

CVE-2026-63342 · Severity: medium · CVSS 6.3 · Published 2026-09-21

Hatchet is a workflow orchestration and task management platform. An authentication bypass flaw in the durable task event log API endpoint allows any authenticated user to access event logs and sensitive business data from other tenants by guessing UUIDs, potentially exposing workflow details, user messages, and timing information across organizational boundaries.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-63342 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63342 being exploited in the wild.
How severe is CVE-2026-63342?
Medium severity, with a CVSS score of 6.3, published 21 September 2026.
Which products and versions are affected?
github.com/hatchet-dev/hatchet (Go) < 0.91.1, SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.
Is there a fix for CVE-2026-63342?
Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63342 attacked?
It is attacked over the network.
Am I affected by CVE-2026-63342?
Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later
    go get github.com/hatchet-dev/hatchet@v0.91.1

Technical details

The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (listDurableEventLog) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from tenants other than their own. This is an Incorrect Authorization (CWE-863) vulnerability requiring low privileges and network access. An attacker must successfully guess the target durable task UUID, after which they can retrieve sensitive event logs containing task display names, workflow identifiers, user messages (potentially containing sensitive business data), wait conditions, branching logic, and timing information. The vulnerability affects versions prior to 0.91.1, which introduced the authorization check; patching to 0.91.1 or later resolves the issue.

Affected products

  • Hatchet Hatchet < 0.91.1

Identifiers

  • CVE-2026-63342
  • GHSA-g26x-m427-f48f
  • GO-2026-6567

Timeline

  • 2026-09-22: disclosed: Published on GitHub Advisory Database
  • 2026-09-22: patched: Fixed in version 0.91.1
  • 2026-06-30: advisory: Initially published on GitHub repository security advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.