# CVE-2026-63342: Hatchet authorization bypass in durable task event log endpoint

Source: https://junglewise.ai/threats/cve-2026-63342-hatchet-authorization-bypass-in-durable-task-event-log-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63342 · Severity: medium · CVSS 6.3 · Published 2026-09-21

Hatchet is a workflow orchestration and task management platform. An authentication bypass flaw in the durable task event log API endpoint allows any authenticated user to access event logs and sensitive business data from other tenants by guessing UUIDs, potentially exposing workflow details, user messages, and timing information across organizational boundaries.

Technologies: [github.com/hatchet-dev/hatchet (Go)](https://junglewise.ai/threats/technologies/github-com-hatchet-dev-hatchet), [Hatchet](https://junglewise.ai/threats/technologies/hatchet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hatchet](https://junglewise.ai/threats/vendors/hatchet).

## Quick answers

**Is CVE-2026-63342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63342 being exploited in the wild.

**How severe is CVE-2026-63342?** Medium severity, with a CVSS score of 6.3, published 21 September 2026.

**Which products and versions are affected?** github.com/hatchet-dev/hatchet (Go) < 0.91.1, SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.

**Is there a fix for CVE-2026-63342?** Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63342 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63342?** Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later

  ```sh
  go get github.com/hatchet-dev/hatchet@v0.91.1
  ```


## Technical details

The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (listDurableEventLog) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from tenants other than their own. This is an Incorrect Authorization (CWE-863) vulnerability requiring low privileges and network access. An attacker must successfully guess the target durable task UUID, after which they can retrieve sensitive event logs containing task display names, workflow identifiers, user messages (potentially containing sensitive business data), wait conditions, branching logic, and timing information. The vulnerability affects versions prior to 0.91.1, which introduced the authorization check; patching to 0.91.1 or later resolves the issue.

## Affected products

- Hatchet Hatchet < 0.91.1

## Identifiers

- CVE-2026-63342
- GHSA-g26x-m427-f48f
- GO-2026-6567

## Timeline

- 2026-09-22: disclosed: Published on GitHub Advisory Database
- 2026-09-22: patched: Fixed in version 0.91.1
- 2026-06-30: advisory: Initially published on GitHub repository security advisory

## References

- [https://api.github.com/users/sfwani](https://api.github.com/users/sfwani)

## Related threats

- [Hatchet resource exhaustion via SNS ingestion endpoint](https://junglewise.ai/threats/cve-2026-108755-hatchet-through-0-110-5-contains-an-allocation-of-resources)
- [Hatchet DurableTask WorkerStatus gRPC authorization bypass via unfiltered tenant_id](https://junglewise.ai/threats/cve-2026-88978-hatchet-durabletask-workerstatus-grpc-authorization-bypass-via)
- [Hatchet cross-tenant durable callback payload disclosure](https://junglewise.ai/threats/cve-2026-84298-hatchet-cross-tenant-durable-callback-payload-disclosure)
- [Hatchet OAuth state CSRF via empty-state collision](https://junglewise.ai/threats/cve-2026-61687-hatchet-oauth-state-csrf-via-empty-state-collision)
- [Hatchet SSRF in SNS UnsubscribeConfirmation handler](https://junglewise.ai/threats/cve-2026-61681-hatchet-ssrf-in-sns-unsubscribeconfirmation-handler)