Executive brief
Hatchet is a workflow orchestration platform that manages long-running tasks across distributed workers. A vulnerability in its gRPC API allows an authenticated attacker with knowledge of another tenant's task UUID to access event logs belonging to that task, exposing sensitive workflow data across tenant boundaries in multi-tenant deployments. Exploitation requires knowledge of the exact UUID of a target task from another tenant, making the practical risk low but still a cross-tenant data breach.
Technical details
The vulnerability is an authorization bypass (CWE-639, CWE-863) in the DurableTask gRPC handleWorkerStatus polling path. The system accepts a caller-supplied durable task UUID and associated node/branch identifiers, then returns event log entries via ListSatisfiedEntries without validating that the requesting tenant owns the task. The root cause is missing tenant_id filtering on the task lookup. The attack vector is network-based via gRPC and requires valid authentication credentials (low privilege sufficient). An authenticated attacker who obtains another tenant's task UUID through an out-of-band channel can query that task's event logs, disclosing sensitive workflow data. Mitigation: patched in version 0.106.1 and later.
Affected products
- Hatchet Hatchet < 0.106.1
Timeline
- 2026-09-04: disclosed: Published by GitHub Advisory Database
- 2026-09-22: patched: Version 0.106.1 released with fix