{"id":"CVE-2026-88978","title":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale","summary":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-639","CWE-863"],"vendor":"hatchet-dev","product":"hatchet","affected":["hatchet < 0.106.1"],"patched":["github.com/hatchet-dev/hatchet 0.106.1"],"published":"2026-09-21","updated":"2026-09-24","sourceUpdated":"2026-09-24T23:19:21.497","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88978","references":[{"url":"https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85","label":"security-advisories@github.com"},{"url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88978"},{"url":"https://github.com/advisories/GHSA-992g-9cr3-vm5x"},{"url":"https://github.com/hatchet-dev/hatchet"}],"tags":["nvd","cve.org","ghsa","go","osv"],"epss":0.00281,"epssPercentile":0.20462,"aliases":["GHSA-992g-9cr3-vm5x","GO-2026-6560"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-24T22:18:07.030391Z"},"ingestedAt":"2026-09-21T16:11:47.442Z","slug":"CVE-2026-88978","body":"## Overview\n\nHatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-88978)\n\nAffected packages:\n\n- `github.com/hatchet-dev/hatchet < 0.106.1`\n\nPatched in:\n\n- `github.com/hatchet-dev/hatchet 0.106.1`\n\nSource: https://github.com/advisories/GHSA-992g-9cr3-vm5x","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}