CVE-2026-54746: hatchet-dev hatchet

Vulnerability summary

CVE-2026-54746 is a medium (CVSS 6.4) vulnerability in hatchet-dev hatchet. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.3% of scored vulnerabilities.

Timeline

1. 28-08-2026
   PublishedVulnerability first disclosed.
2. 28-08-2026
   Last modifiedVulnerability information updated.

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher. This can cause cross-tenant integrity impact and denial of service on multi-tenant Hatchet Cloud or shared self-hosted deployments. Single-tenant deployments are not practically affected because the attacker and target tenant are the same. This issue is fixed in version 0.91.1.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.