Is CVE-2026-88978 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88978 being exploited in the wild.

How severe is CVE-2026-88978?

Medium severity, with a CVSS score of 4.3, published 21 September 2026.

Which products and versions are affected?

github.com/hatchet-dev/hatchet (Go) < 0.106.1, SEMVER:introduced=0,fixed=0.106.1; Hatchet < 0.106.1.

Is there a fix for CVE-2026-88978?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-88978 attacked?

It is attacked over the network.

Am I affected by CVE-2026-88978?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88978: Hatchet DurableTask WorkerStatus gRPC authorization bypass via unfiltered tenant_id

Q: Is there a fix for CVE-2026-88978?

Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-88978 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-88978?

Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88978 · Severity: medium · CVSS 4.3 · Published 2026-09-21

Hatchet is a workflow orchestration platform that manages long-running tasks across distributed workers. A vulnerability in its gRPC API allows an authenticated attacker with knowledge of another tenant's task UUID to access event logs belonging to that task, exposing sensitive workflow data across tenant boundaries in multi-tenant deployments. Exploitation requires knowledge of the exact UUID of a target task from another tenant, making the practical risk low but still a cross-tenant data breach.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-88978 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88978 being exploited in the wild.
How severe is CVE-2026-88978?: Medium severity, with a CVSS score of 4.3, published 21 September 2026.
Which products and versions are affected?: github.com/hatchet-dev/hatchet (Go) < 0.106.1, SEMVER:introduced=0,fixed=0.106.1; Hatchet < 0.106.1.
Is there a fix for CVE-2026-88978?: Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88978 attacked?: It is attacked over the network.
Am I affected by CVE-2026-88978?: Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later
```
go get github.com/hatchet-dev/hatchet@v0.106.1
```

Technical details

The vulnerability is an authorization bypass (CWE-639, CWE-863) in the DurableTask gRPC handleWorkerStatus polling path. The system accepts a caller-supplied durable task UUID and associated node/branch identifiers, then returns event log entries via ListSatisfiedEntries without validating that the requesting tenant owns the task. The root cause is missing tenant_id filtering on the task lookup. The attack vector is network-based via gRPC and requires valid authentication credentials (low privilege sufficient). An authenticated attacker who obtains another tenant's task UUID through an out-of-band channel can query that task's event logs, disclosing sensitive workflow data. Mitigation: patched in version 0.106.1 and later.

Affected products

Hatchet Hatchet < 0.106.1

Identifiers

CVE-2026-88978
GHSA-992g-9cr3-vm5x
GO-2026-6560

Timeline

2026-09-04: disclosed: Published by GitHub Advisory Database
2026-09-22: patched: Version 0.106.1 released with fix

References

https://api.github.com/users/d3do-23

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.