# CVE-2026-88978: Hatchet DurableTask WorkerStatus gRPC authorization bypass via unfiltered tenant_id

Source: https://junglewise.ai/threats/cve-2026-88978-hatchet-durabletask-workerstatus-grpc-authorization-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-88978 · Severity: medium · CVSS 4.3 · Published 2026-09-21

Hatchet is a workflow orchestration platform that manages long-running tasks across distributed workers. A vulnerability in its gRPC API allows an authenticated attacker with knowledge of another tenant's task UUID to access event logs belonging to that task, exposing sensitive workflow data across tenant boundaries in multi-tenant deployments. Exploitation requires knowledge of the exact UUID of a target task from another tenant, making the practical risk low but still a cross-tenant data breach.

Technologies: [github.com/hatchet-dev/hatchet (Go)](https://junglewise.ai/threats/technologies/github-com-hatchet-dev-hatchet), [Hatchet](https://junglewise.ai/threats/technologies/hatchet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hatchet](https://junglewise.ai/threats/vendors/hatchet).

## Quick answers

**Is CVE-2026-88978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88978 being exploited in the wild.

**How severe is CVE-2026-88978?** Medium severity, with a CVSS score of 4.3, published 21 September 2026.

**Which products and versions are affected?** github.com/hatchet-dev/hatchet (Go) < 0.106.1, SEMVER:introduced=0,fixed=0.106.1; Hatchet < 0.106.1.

**Is there a fix for CVE-2026-88978?** Yes. github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88978 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88978?** Check whether you run github.com/hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/hatchet-dev/hatchet (Go): upgrade to 0.106.1 or later

  ```sh
  go get github.com/hatchet-dev/hatchet@v0.106.1
  ```


## Technical details

The vulnerability is an authorization bypass (CWE-639, CWE-863) in the DurableTask gRPC handleWorkerStatus polling path. The system accepts a caller-supplied durable task UUID and associated node/branch identifiers, then returns event log entries via ListSatisfiedEntries without validating that the requesting tenant owns the task. The root cause is missing tenant_id filtering on the task lookup. The attack vector is network-based via gRPC and requires valid authentication credentials (low privilege sufficient). An authenticated attacker who obtains another tenant's task UUID through an out-of-band channel can query that task's event logs, disclosing sensitive workflow data. Mitigation: patched in version 0.106.1 and later.

## Affected products

- Hatchet Hatchet < 0.106.1

## Identifiers

- CVE-2026-88978
- GHSA-992g-9cr3-vm5x
- GO-2026-6560

## Timeline

- 2026-09-04: disclosed: Published by GitHub Advisory Database
- 2026-09-22: patched: Version 0.106.1 released with fix

## References

- [https://api.github.com/users/d3do-23](https://api.github.com/users/d3do-23)

## Related threats

- [Hatchet resource exhaustion via SNS ingestion endpoint](https://junglewise.ai/threats/cve-2026-108755-hatchet-through-0-110-5-contains-an-allocation-of-resources)
- [Hatchet cross-tenant durable callback payload disclosure](https://junglewise.ai/threats/cve-2026-84298-hatchet-cross-tenant-durable-callback-payload-disclosure)
- [Hatchet authorization bypass in durable task event log endpoint](https://junglewise.ai/threats/cve-2026-63342-hatchet-authorization-bypass-in-durable-task-event-log-endpoint)
- [Hatchet OAuth state CSRF via empty-state collision](https://junglewise.ai/threats/cve-2026-61687-hatchet-oauth-state-csrf-via-empty-state-collision)
- [Hatchet SSRF in SNS UnsubscribeConfirmation handler](https://junglewise.ai/threats/cve-2026-61681-hatchet-ssrf-in-sns-unsubscribeconfirmation-handler)