GHSA-8x7x-83cf-c3pg

Source

https://github.com/advisories/GHSA-8x7x-83cf-c3pg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8x7x-83cf-c3pg/GHSA-8x7x-83cf-c3pg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8x7x-83cf-c3pg

Aliases

CVE-2026-54746

Published

2026-08-28T16:08:58Z

Modified

2026-08-28T16:15:06.406468814Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Details

Summary

A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token (the lowest credential Hatchet issues — an OWNER of a brand-new tenant) to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UUID belonging to any other tenant on the same Hatchet instance. The two affected RPCs — Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe — read the caller's tenant from the bearer-token context only for analytics and response shaping, and never use it to authorise the worker_id from the request body.

Impact

This CVE requires the attacker to successfully guess the target UUID. Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance: - Hatchet Cloud (multi-tenant SaaS) — every tenant is exposed to every other tenant. - Self-hosted Hatchet with multiple internal teams / business units sharing one instance — each team is exposed to every other team on the box. - Any deployment where a single tenant's API token can be obtained by an attacker (e.g. a leaked low-privilege CI token from a single tenant). One token is enough to attack every other tenant on the same instance.

Single-tenant self-hosted deployments are unaffected in practice (the "victim" and "attacker" tenants would be the same).

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-28T16:08:58Z",
    "cwe_ids": [
        "CWE-639",
        "CWE-862"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/hatchet-dev/hatchet

Package

Name: github.com/hatchet-dev/hatchet; View open source insights on deps.dev
Purl: pkg:golang/github.com/hatchet-dev/hatchet

Affected ranges

Type: SEMVER
Events: Introduced

0.40.0

Fixed

0.91.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8x7x-83cf-c3pg/GHSA-8x7x-83cf-c3pg.json"