# CVE-2026-84298: Hatchet cross-tenant durable callback payload disclosure

Source: https://junglewise.ai/threats/cve-2026-84298-hatchet-cross-tenant-durable-callback-payload-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84298 · Severity: low · CVSS 3.1 · Published 2026-09-21

Hatchet is a distributed task orchestration platform used to coordinate background jobs and workflows across services. A vulnerability in the V1 Dispatcher allows a worker on one tenant to intercept callback payloads destined for another tenant's tasks, potentially exposing sensitive business logic and data. Exploitation requires knowledge of a target task's external ID obtained through an out-of-band source, making the practical risk low but non-zero in multi-tenant deployments.

Technologies: [github.com/hatchet-dev/hatchet (Go)](https://junglewise.ai/threats/technologies/github-com-hatchet-dev-hatchet), [Hatchet](https://junglewise.ai/threats/technologies/hatchet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hatchet](https://junglewise.ai/threats/vendors/hatchet).

## Quick answers

**Is CVE-2026-84298 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84298 being exploited in the wild.

**How severe is CVE-2026-84298?** Low severity, with a CVSS score of 3.1, published 21 September 2026.

**Which products and versions are affected?** github.com/hatchet-dev/hatchet (Go) < 0.95.3, SEMVER:introduced=0,fixed=0.95.3; Hatchet V1 Dispatcher.

**Is there a fix for CVE-2026-84298?** Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84298 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84298?** Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/hatchet-dev/hatchet (Go): upgrade to 0.95.3 or later

  ```sh
  go get github.com/hatchet-dev/hatchet@v0.95.3
  ```


## Technical details

The V1 DurableTask stream handler in Hatchet registers worker-supplied durable task external IDs in an in-memory callback routing map before validating tenant ownership. When the tenant-scoped ownership check fails, the error is logged but the map entry persists until the stream closes. Durable callback delivery resolves destination streams by task_external_id only without verifying tenant identity. This allows an attacker with a worker token on tenant A to hold a stream open and receive tenant B's durable callback payloads if they know the target task's UUIDv4 external ID. The vulnerability affects multi-tenant Hatchet Cloud and self-hosted deployments hosting multiple tenants or business units on a single instance. Single-tenant deployments are not affected in practice.

## Affected products

- Hatchet Hatchet V1 Dispatcher

## Identifiers

- CVE-2026-84298
- GHSA-9q4h-f4x5-ffq8
- GO-2026-6561

## Timeline

- 2026-09-22: disclosed

## Related threats

- [Hatchet resource exhaustion via SNS ingestion endpoint](https://junglewise.ai/threats/cve-2026-108755-hatchet-through-0-110-5-contains-an-allocation-of-resources)
- [Hatchet DurableTask WorkerStatus gRPC authorization bypass via unfiltered tenant_id](https://junglewise.ai/threats/cve-2026-88978-hatchet-durabletask-workerstatus-grpc-authorization-bypass-via)
- [Hatchet authorization bypass in durable task event log endpoint](https://junglewise.ai/threats/cve-2026-63342-hatchet-authorization-bypass-in-durable-task-event-log-endpoint)
- [Hatchet OAuth state CSRF via empty-state collision](https://junglewise.ai/threats/cve-2026-61687-hatchet-oauth-state-csrf-via-empty-state-collision)
- [Hatchet SSRF in SNS UnsubscribeConfirmation handler](https://junglewise.ai/threats/cve-2026-61681-hatchet-ssrf-in-sns-unsubscribeconfirmation-handler)