CVE-2026-54746

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54746

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54746.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54746

Aliases

GHSA-8x7x-83cf-c3pg

Published

2026-08-28T16:08:37.816Z

Modified

2026-08-30T03:46:44.546573043Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Details

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher. This can cause cross-tenant integrity impact and denial of service on multi-tenant Hatchet Cloud or shared self-hosted deployments. Single-tenant deployments are not practically affected because the attacker and target tenant are the same. This issue is fixed in version 0.91.1.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54746.json",
    "cwe_ids": [
        "CWE-639",
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/hatchet-dev/hatchet

Affected ranges

Type

GIT

Repo

https://github.com/hatchet-dev/hatchet

Events

Introduced

9efd9368fdef6eb2f0497e28fdc0d66ddeabfac9

Fixed

591a30deb8b80f02eba7014997de387d710986c9

Fixed

06c1fe43543e853ea98ecc2e6a575e2b8310bbeb

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.40.0"
        },
        {
            "fixed": "0.91.1"
        }
    ]
}

Affected versions

py/1.*

py/1.33.10

py/1.33.11

py/1.33.12

py/1.33.13

py/1.33.6

py/1.33.7

py/1.33.9

rb/0.*

rb/0.3.1

v0.*

v0.40.0

v0.41.0

v0.41.1

v0.41.2

v0.42.0

v0.42.1

v0.42.10

v0.42.11

v0.42.12

v0.42.13

v0.42.14

v0.42.2

v0.42.3

v0.42.4

v0.42.5

v0.42.6

v0.42.9

v0.43.0

v0.43.1

v0.43.2

v0.44.0

v0.44.1

v0.44.2

v0.44.3

v0.44.4

v0.44.5

v0.44.7

v0.44.8

v0.45.0

v0.45.1

v0.45.2

v0.45.3

v0.46.0

v0.46.1

v0.46.2

v0.46.3

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.48.3

v0.48.4

v0.48.5

v0.49.1

v0.49.1-alpha.0

v0.49.2

v0.49.3

v0.49.4

v0.49.5-alpha.0

v0.50.0

v0.50.0-alpha.0

v0.50.0-alpha.1

v0.50.0-alpha.2

v0.50.0-alpha.3

v0.50.1

v0.50.1-alpha.0

v0.50.2

v0.50.3

v0.50.4

v0.51.0

v0.51.0-beta.0

v0.51.0-beta.1

v0.51.0-beta.2

v0.51.1

v0.51.2

v0.51.3

v0.51.4

v0.51.5

v0.52.0

v0.52.1

v0.52.10

v0.52.11

v0.52.12

v0.52.2

v0.52.3

v0.52.4

v0.52.5

v0.52.6

v0.52.7

v0.52.8

v0.52.9

v0.53.0

v0.53.0-alpha.2

v0.53.1

v0.53.10

v0.53.11

v0.53.15

v0.53.2

v0.53.4

v0.53.5

v0.53.6

v0.53.7

v0.53.8

v0.53.9

v0.54.0

v0.54.1

v0.54.10

v0.54.12

v0.54.13

v0.54.14

v0.54.2

v0.54.3

v0.54.4

v0.54.5

v0.54.6

v0.54.7

v0.54.8

v0.54.9

v0.55.0

v0.55.1

v0.55.12

v0.55.13

v0.55.14

v0.55.15

v0.55.16

v0.55.17

v0.55.18

v0.55.19

v0.55.20

v0.55.21

v0.55.22

v0.55.23

v0.55.24

v0.55.25

v0.55.26

v0.55.27

v0.55.28

v0.55.29

v0.55.3

v0.55.4

v0.55.5

v0.55.6

v0.55.7

v0.55.8

v0.55.9

v0.56.0

v0.56.1

v0.56.2

v0.56.3

v0.56.4

v0.57.0

v0.57.1

v0.58.0

v0.58.1

v0.58.10

v0.58.11

v0.58.2

v0.58.3

v0.58.4

v0.58.5

v0.58.6

v0.58.7

v0.58.8

v0.58.9

v0.59.0

v0.59.1

v0.59.2

v0.59.3

v0.59.4

v0.59.5

v0.60.0

v0.60.1

v0.60.2

v0.60.3

v0.60.4

v0.60.5

v0.61.0

v0.61.1

v0.61.10

v0.61.11

v0.61.12

v0.61.2

v0.61.3

v0.61.4

v0.61.5

v0.61.6

v0.61.7

v0.61.8

v0.61.9

v0.62.0

v0.62.1

v0.62.3

v0.62.4

v0.62.5

v0.62.6

v0.62.7

v0.63.0

v0.63.1

v0.63.2

v0.63.3

v0.63.4

v0.63.5

v0.63.6

v0.64.0

v0.64.1

v0.64.10

v0.64.11

v0.64.12

v0.64.13

v0.64.2

v0.64.3

v0.64.4

v0.64.5

v0.64.6

v0.64.7

v0.64.8

v0.64.9

v0.65.0

v0.65.1

v0.65.2

v0.65.3

v0.66.0

v0.66.1

v0.66.2

v0.66.3

v0.66.4

v0.66.5

v0.66.7

v0.66.8

v0.67.0

v0.67.1

v0.67.2

v0.67.3

v0.67.4

v0.67.5

v0.67.6

v0.67.7

v0.67.8

v0.68.0

v0.68.1

v0.68.10

v0.68.2

v0.68.3

v0.68.4

v0.68.5

v0.68.6

v0.68.7

v0.68.8

v0.68.9

v0.69.0

v0.69.1

v0.69.2

v0.69.3

v0.69.4

v0.69.5

v0.69.6

v0.69.7

v0.69.8

v0.69.9

v0.70.0

v0.70.1

v0.70.2

v0.70.3

v0.70.4

v0.70.5

v0.70.6

v0.70.7

v0.71.0

v0.71.1

v0.71.10

v0.71.11

v0.71.12

v0.71.13

v0.71.14

v0.71.15

v0.71.2

v0.71.3

v0.71.4

v0.71.5

v0.71.6

v0.71.7

v0.71.8

v0.71.8-alpha.0

v0.71.9

v0.72.0

v0.72.1

v0.72.2

v0.72.3

v0.72.4

v0.72.5

v0.72.6

v0.72.7

v0.72.8

v0.73.0

v0.73.1

v0.73.10

v0.73.100

v0.73.101

v0.73.102

v0.73.103

v0.73.104

v0.73.106

v0.73.107

v0.73.108

v0.73.109

v0.73.11

v0.73.110

v0.73.111

v0.73.112

v0.73.12

v0.73.13

v0.73.14

v0.73.15

v0.73.16

v0.73.17

v0.73.18

v0.73.19

v0.73.2

v0.73.20

v0.73.21

v0.73.22

v0.73.23

v0.73.24

v0.73.25

v0.73.26

v0.73.28

v0.73.29

v0.73.3

v0.73.30

v0.73.31

v0.73.32

v0.73.33

v0.73.34

v0.73.35

v0.73.36

v0.73.37

v0.73.38

v0.73.39

v0.73.4

v0.73.40

v0.73.40-alpha.0

v0.73.41

v0.73.42

v0.73.43

v0.73.44

v0.73.45

v0.73.46

v0.73.47

v0.73.48

v0.73.49

v0.73.5

v0.73.50

v0.73.51

v0.73.52

v0.73.53

v0.73.54

v0.73.55

v0.73.56

v0.73.58

v0.73.59

v0.73.6

v0.73.60

v0.73.61

v0.73.62

v0.73.63

v0.73.64

v0.73.65

v0.73.66

v0.73.67

v0.73.68

v0.73.7

v0.73.70

v0.73.71

v0.73.72

v0.73.73

v0.73.74

v0.73.75

v0.73.76

v0.73.77

v0.73.78

v0.73.79

v0.73.8

v0.73.80

v0.73.81

v0.73.82

v0.73.83

v0.73.84

v0.73.85

v0.73.86

v0.73.87

v0.73.88

v0.73.89

v0.73.9

v0.73.90

v0.73.91

v0.73.92

v0.73.93

v0.73.94

v0.73.95

v0.73.96

v0.73.97

v0.73.98

v0.73.99

v0.74.1

v0.74.10

v0.74.11

v0.74.12

v0.74.13

v0.74.14

v0.74.2

v0.74.3

v0.74.4

v0.74.5

v0.74.6

v0.74.7

v0.74.8

v0.74.9

v0.75.0

v0.75.1

v0.75.2

v0.75.3

v0.75.4

v0.77.0

v0.77.1

v0.77.10

v0.77.11

v0.77.13

v0.77.15

v0.77.16

v0.77.17

v0.77.18

v0.77.2-alpha.1

v0.77.2-alpha.2

v0.77.2-alpha.3

v0.77.2-alpha.4

v0.77.2-alpha.5

v0.77.20

v0.77.21

v0.77.22

v0.77.23

v0.77.24

v0.77.25

v0.77.26

v0.77.27

v0.77.28

v0.77.29

v0.77.3

v0.77.30

v0.77.31

v0.77.32

v0.77.33

v0.77.34

v0.77.35

v0.77.36

v0.77.37

v0.77.4

v0.77.5

v0.77.6

v0.77.7

v0.77.8

v0.77.9

v0.78.0

v0.78.1

v0.78.10

v0.78.11

v0.78.12

v0.78.13

v0.78.14

v0.78.15

v0.78.16

v0.78.17

v0.78.18

v0.78.19

v0.78.2

v0.78.20

v0.78.21

v0.78.22

v0.78.23

v0.78.24

v0.78.25

v0.78.26

v0.78.27

v0.78.28

v0.78.29

v0.78.3

v0.78.30

v0.78.4

v0.78.5

v0.78.6

v0.78.7

v0.78.8

v0.78.9

v0.79.0

v0.79.1

v0.79.10

v0.79.11

v0.79.12

v0.79.13

v0.79.14

v0.79.15

v0.79.16

v0.79.17

v0.79.18

v0.79.19

v0.79.2

v0.79.20

v0.79.21

v0.79.22

v0.79.23

v0.79.24

v0.79.25

v0.79.26

v0.79.27

v0.79.28

v0.79.29

v0.79.3

v0.79.30

v0.79.31

v0.79.32

v0.79.33

v0.79.34

v0.79.35

v0.79.36

v0.79.37

v0.79.38

v0.79.39

v0.79.4

v0.79.40

v0.79.41

v0.79.43

v0.79.44

v0.79.5

v0.79.6

v0.79.7

v0.79.8

v0.79.9

v0.80.0

v0.80.1

v0.80.10

v0.80.2

v0.80.3

v0.80.4

v0.80.5

v0.80.6

v0.80.7

v0.80.8

v0.80.9

v0.81.0

v0.81.1

v0.81.2

v0.81.3

v0.81.4

v0.82.0

v0.82.1

v0.82.2

v0.82.3

v0.83.0

v0.83.1

v0.83.10

v0.83.12

v0.83.13

v0.83.14

v0.83.15

v0.83.16

v0.83.17

v0.83.18

v0.83.19

v0.83.2

v0.83.20

v0.83.21

v0.83.22

v0.83.23

v0.83.24

v0.83.25

v0.83.26

v0.83.27

v0.83.28

v0.83.29

v0.83.3

v0.83.30

v0.83.31

v0.83.32

v0.83.33

v0.83.34

v0.83.35

v0.83.36

v0.83.37

v0.83.38

v0.83.39

v0.83.4

v0.83.40

v0.83.41

v0.83.42

v0.83.43

v0.83.44

v0.83.45

v0.83.46

v0.83.47

v0.83.48

v0.83.49

v0.83.5

v0.83.50

v0.83.51

v0.83.52

v0.83.53

v0.83.54

v0.83.55

v0.83.56

v0.83.57

v0.83.58

v0.83.59

v0.83.6

v0.83.60

v0.83.61

v0.83.7

v0.83.8

v0.83.9

v0.85.0

v0.85.1

v0.85.10

v0.85.11

v0.85.2

v0.85.3

v0.85.4

v0.85.5

v0.85.6

v0.85.7

v0.85.8

v0.85.9

v0.86.0

v0.86.1

v0.86.10

v0.86.11

v0.86.12

v0.86.14

v0.86.15

v0.86.16

v0.86.17

v0.86.18

v0.86.19

v0.86.2

v0.86.20

v0.86.21

v0.86.22

v0.86.23

v0.86.24

v0.86.25

v0.86.26

v0.86.27

v0.86.28

v0.86.29

v0.86.3

v0.86.30

v0.86.31

v0.86.32

v0.86.4

v0.86.5

v0.86.6

v0.86.7

v0.86.8

v0.86.9

v0.87.0

v0.87.1

v0.87.10

v0.87.11

v0.87.12

v0.87.13

v0.87.14

v0.87.2

v0.87.3

v0.87.4

v0.87.5

v0.87.6

v0.87.7

v0.87.8

v0.87.9

v0.88.0

v0.88.1

v0.88.2

v0.88.3

v0.88.4

v0.88.5

v0.88.6

v0.88.7

v0.88.8

v0.89.0

v0.89.2

v0.89.3

v0.89.4

v0.89.5

v0.89.6

v0.89.7

v0.90.0

v0.90.1

v0.90.10

v0.90.11

v0.90.12

v0.90.13

v0.90.2

v0.90.3

v0.90.4

v0.90.5

v0.90.6

v0.90.7

v0.90.8

v0.90.9

v0.91.0

vscode/v0.*

vscode/v0.1.0

vscode/v0.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54746.json"