GHSA-992g-9cr3-vm5x
Suggest an improvement- Source
- https://github.com/advisories/GHSA-992g-9cr3-vm5x
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-992g-9cr3-vm5x/GHSA-992g-9cr3-vm5x.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-992g-9cr3-vm5x
- Aliases
- Published
- 2026-09-22T20:40:46Z
- Modified
- 2026-09-22T21:00:04Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
- Details
-
Cross-tenant disclosure risk on
DurableTaskbidi RPCThis is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via the
handleWorkerStatuspolling path.Impact
This advisory requires an attacker to successfully guess a durable task's external uuid belonging to another tenant. External ids are generated uuid v4s (
uuid.New()in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:
- Hatchet Cloud (multi-tenant SaaS)
- Self-hosted Hatchet with multiple internal teams / business units sharing one instance
- Any deployment where a single tenant's API token can be obtained by an attacker
Single-tenant self-hosted deployments are unaffected in practice (the "victim" and "attacker" tenants would be the same).
- Database specific
{ "cwe_ids": [ "CWE-639", "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-09-22T20:40:46Z", "nvd_published_at": "2026-09-21T16:17:26Z", "severity": "MODERATE" }- References
Affected packages
Go / github.com/hatchet-dev/hatchet
Package
- Name
- github.com/hatchet-dev/hatchet
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hatchet-dev/hatchet