CVE-2026-88978Medium· 4.3▾ SunlitHatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/hatchet-dev/hatchet < 0.106.1Patched in:
github.com/hatchet-dev/hatchet 0.106.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63342Medium· 6.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
CVE-2026-84298Low· 3.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
CVE-2026-61681Medium· 4.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
CVE-2026-61687High· 7.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
CVE-2026-108755Medium· 5.3Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint
CVE-2026-54746Medium· 6.4Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale