GO-2026-6560 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenantid filter in github.com/hatchet-dev/hatchet...

PT-2026-105581

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant id filter in github.com/hatchet-dev/hatchet...

GHSA-992G-9CR3-VM5X Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Cross-tenant disclosure risk on DurableTask bidi RPC This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via th...

EUVD-2026-83980

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenantid filter...

CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durableevents.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant...

PT-2026-96154

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.106.1 Description The WorkerStatus gRPC polling path in pkg/repository/durable events.go passes caller-supplied durable task, node, and branch identifiers to the ListSatisfiedEntries function without applying a tena...