Is CVE-2026-84298 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84298 being exploited in the wild.

How severe is CVE-2026-84298?

Low severity, with a CVSS score of 3.1, published 21 September 2026.

Which products and versions are affected?

github.com/hatchet-dev/hatchet (Go) < 0.95.3, SEMVER:introduced=0,fixed=0.95.3; Hatchet V1 Dispatcher.

Is there a fix for CVE-2026-84298?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84298 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-84298?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84298: Hatchet cross-tenant durable callback payload disclosure

Q: Is there a fix for CVE-2026-84298?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84298 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-84298?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84298 · Severity: low · CVSS 3.1 · Published 2026-09-21

Hatchet is a distributed task orchestration platform used to coordinate background jobs and workflows across services. A vulnerability in the V1 Dispatcher allows a worker on one tenant to intercept callback payloads destined for another tenant's tasks, potentially exposing sensitive business logic and data. Exploitation requires knowledge of a target task's external ID obtained through an out-of-band source, making the practical risk low but non-zero in multi-tenant deployments.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-84298 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84298 being exploited in the wild.
How severe is CVE-2026-84298?: Low severity, with a CVSS score of 3.1, published 21 September 2026.
Which products and versions are affected?: github.com/hatchet-dev/hatchet (Go) < 0.95.3, SEMVER:introduced=0,fixed=0.95.3; Hatchet V1 Dispatcher.
Is there a fix for CVE-2026-84298?: Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84298 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-84298?: Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later
```
go get github.com/hatchet-dev/hatchet@v0.95.3
```

Technical details

The V1 DurableTask stream handler in Hatchet registers worker-supplied durable task external IDs in an in-memory callback routing map before validating tenant ownership. When the tenant-scoped ownership check fails, the error is logged but the map entry persists until the stream closes. Durable callback delivery resolves destination streams by task_external_id only without verifying tenant identity. This allows an attacker with a worker token on tenant A to hold a stream open and receive tenant B's durable callback payloads if they know the target task's UUIDv4 external ID. The vulnerability affects multi-tenant Hatchet Cloud and self-hosted deployments hosting multiple tenants or business units on a single instance. Single-tenant deployments are not affected in practice.

Affected products

Hatchet Hatchet V1 Dispatcher

Identifiers

CVE-2026-84298
GHSA-9q4h-f4x5-ffq8
GO-2026-6561

Timeline

2026-09-22: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.