Vulnerability in Hatchet's DurableTask Handling Affects Multi-Tenant Deployments
CVE-2026-84298

3.1LOW

Key Information:

Vendor

Hatchet-dev

Status
Hatchet
Vendor
CVE Published:
21 September 2026

What is CVE-2026-84298?

Hatchet, a platform designed for orchestrating background tasks, AI agents, and durable workflows, has a vulnerability in its V1 DurableTask stream handler. Prior to version 0.95.3, the handler mistakenly stored external task IDs provided by workers in its routing map before ensuring tenant ownership was verified. This oversight allows an authenticated worker from one tenant to access callback results of tasks belonging to another tenant, given they know the task UUID and keep a stream open on the same dispatcher process. While single-tenant deployments are practical safeguards against this issue, multi-tenant environments face significant risks. This vulnerability has been addressed in version 0.95.3 with a fix that ensures proper tenant validation.

Affected Version(s)

hatchet < 0.95.3

References

https://github.com/hatchet-dev/hatchet/security/advisorie...
x_refsource_CONFIRM
https://github.com/hatchet-dev/hatchet/commit/9555bfdd1e9...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.