CVE-2026-42572: hatchet-dev hatchet

Vulnerability summary

CVE-2026-42572 is a medium (CVSS 6.5) vulnerability in hatchet-dev hatchet. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.

Timeline

1. 14-05-2026
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.