{"data":{"id":"0451d51c-cca6-4487-99ef-26775406c4c6","title":"CVE-2026-88978: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1…","summary":"Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, has a flaw in versions before 0.106.1. The WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter. An authenticated tenant worker that knows another tenant's durable-task UUID can retrieve matching durable event-log records. The source notes that the UUIDv4 requirement makes exploitation unlikely and that single-tenant deployments are unaffected in practice.","solution":"This issue is fixed in version 0.106.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88978","publishedAt":"2026-09-21T16:17:26.010Z","cveId":"CVE-2026-88978","cweIds":["CWE-639","CWE-863"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/hatchet-dev/hatchet@< 0.106.1 (fixed: 0.106.1)"],"affectedPackageNames":["github.com/hatchet-dev/hatchet"],"affectedPackageRefs":["go:github.com/hatchet-dev/hatchet"],"affectedVendors":[],"affectedVendorsRaw":["Hatchet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hatchet cross-tenant data exposure through WorkerStatus gRPC polling","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00281,"epssCheckedAt":"2026-11-10T00:11:22.478Z","kevDateAdded":null,"advisoryAliases":["GHSA-992g-9cr3-vm5x"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:26.536Z","patchAvailable":true,"disclosureDate":"2026-09-21T16:17:26.010Z","fixReleasedAt":"2026-09-04T18:24:00.000Z","daysToFix":-17,"fixCheckedAt":"2026-10-29T21:30:23.542Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/hatchet-dev/hatchet","fixedVersion":"0.106.1","matchedVersion":"v0.106.1","fixReleasedAt":"2026-09-04T18:24:00.000Z","daysToFix":-17,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:23.394Z"}]}}