hatchet-dev hatchet vulnerabilities

Latest hatchet-dev hatchet CVEs

Newest publication first

1. CVE-2026-108755 Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

   Published 2026-10-11

   Medium·CVSS 6.9 EPSS 0.32%

   Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/{tenant}/{event}...

2. CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

   Published 2026-09-21

   Medium·CVSS 4.3 EPSS 0.28%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries...

3. CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

   Published 2026-09-21

   Low·CVSS 3.1 EPSS 0.24%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and ca...

4. CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

   Published 2026-09-21

   High·CVSS 7.1 EPSS 0.17%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal,...

5. CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

   Published 2026-09-21

   Medium·CVSS 6.3 EPSS 0.31%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEven...

6. CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

   Published 2026-09-21

   Medium·CVSS 4.1 EPSS 0.31%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though...

7. CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

   Published 2026-08-28

   Medium·CVSS 6.4 EPSS 0.37%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertW...

8. CVE-2026-42572 Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

   Published 2026-05-14

   Medium·CVSS 6.5 EPSS 0.18%

   Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user aut...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.