EUVD-2026-83978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-63342

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, is affected by a cross-tenant authorization bypass prior to version 0.91.1 . The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (implemented by listDurableEventLog) fails to require the target ten...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-61681

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows. Prior to version 0.91.1 , the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload(), even though BuildSignature(...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

PT-2026-96143

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description An issue exists in the platform used for orchestrating background tasks, AI agents, and durable workflows. The endpoint 'GET /api/v1/stable/durable-tasks/durable-task', implemented by the...

CVE-2026-63342: Incorrect Authorization

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

CVE-2026-61687: Improper Authentication

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

PT-2026-96154

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.106.1 Description The WorkerStatus gRPC polling path in pkg/repository/durable events.go passes caller-supplied durable task, node, and branch identifiers to the ListSatisfiedEntries function without applying a tena...

CVE-2026-84298: Authorization Bypass Through User-Controlled Key

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied taskexternalid values in the durableInvocations routing map before tenant ownership is verified, and callback delivery...

PT-2026-96144

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.95.3 Description The V1 DurableTask stream handler stores worker-supplied task external id values in the durableInvocations routing map before verifying tenant ownership. Because callback delivery resolves this map...

CVE-2026-88978: Authorization Bypass Through User-Controlled Key

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

PT-2026-96142

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description A flaw in the ValidateOAuthState function allows an unauthenticated attacker to bind a victim's session to an attacker-controlled OAuth identity. This occurs because the system clears the oauth stat...

PT-2026-96141

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get request on the UnsubscribeURL parameter within the payload. Because the BuildSignature...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

SUSE CVE-2026-54746

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...