CVE-2026-88978: hatchet-dev hatchet

Vulnerability summary

CVE-2026-88978 is a medium (CVSS 4.3) vulnerability in hatchet-dev hatchet. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.4% of scored vulnerabilities.

Timeline

1. 21-09-2026
   PublishedVulnerability first disclosed.
2. 24-09-2026
   Last modifiedVulnerability information updated.

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.