Background Task Management Vulnerability in Hatchet by Hatchet Dev

CVE-2026-88978

What is CVE-2026-88978?

Hatchet, a robust platform designed for orchestrating background tasks and workflows, has encountered an improper authorization vulnerability prior to version 0.106.1. The WorkerStatus gRPC polling path inadequately manages tenant-specific identifiers, enabling an authenticated tenant worker to potentially access another tenant's durable-task UUID and retrieve pertinent event-log records due to the lack of tenant filtering. While the likelihood of exploitation is minimal due to the UUIDv4 requirement, single-tenant systems remain unaffected. This issue highlights the importance of securing inter-tenant data access in multi-tenant architectures.

References