Skip to content
OpenAdvisories

Package · Go

github.com/hatchet-dev/hatchet

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 4.3
    CVE-2026-88978

    Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to …

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • Low 3.1
    CVE-2026-84298

    Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownershi…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • High 7.1
    CVE-2026-61687

    hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty stat…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • Medium 6.3
    CVE-2026-63342

    Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implement…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • Medium 4.1
    CVE-2026-61681

    Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after Verify…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • Medium 6.4
    CVE-2026-54746

    Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context …

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go
  • Medium 5.3
    CVE-2026-42572

    Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for t…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go