Executive brief
Hatchet is a distributed task orchestration platform used to coordinate background jobs and workflows across services. A vulnerability in the V1 Dispatcher allows a worker on one tenant to intercept callback payloads destined for another tenant's tasks, potentially exposing sensitive business logic and data. Exploitation requires knowledge of a target task's external ID obtained through an out-of-band source, making the practical risk low but non-zero in multi-tenant deployments.
Technical details
The V1 DurableTask stream handler in Hatchet registers worker-supplied durable task external IDs in an in-memory callback routing map before validating tenant ownership. When the tenant-scoped ownership check fails, the error is logged but the map entry persists until the stream closes. Durable callback delivery resolves destination streams by task_external_id only without verifying tenant identity. This allows an attacker with a worker token on tenant A to hold a stream open and receive tenant B's durable callback payloads if they know the target task's UUIDv4 external ID. The vulnerability affects multi-tenant Hatchet Cloud and self-hosted deployments hosting multiple tenants or business units on a single instance. Single-tenant deployments are not affected in practice.
Affected products
- Hatchet Hatchet V1 Dispatcher
Timeline
- 2026-09-22: disclosed