{"data":{"id":"a87311f9-32b7-4e79-997b-46ca3fed6bfd","title":"CVE-2026-42572: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39…","summary":"CVE-2026-42572 affects Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, prior to 0.83.39. A missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint skipped the tenant-membership check, so a user authenticated to any tenant on the same instance could supply another tenant's UUID and a DAG UUID from that tenant and receive that DAG's task metadata.","solution":"Fixed in 0.83.39.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42572","publishedAt":"2026-05-14T18:16:47.943Z","cveId":"CVE-2026-42572","cweIds":["CWE-639","CWE-863"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["github.com/hatchet-dev/hatchet@<= 0.83.38 (fixed: 0.83.39)"],"affectedPackageNames":["github.com/hatchet-dev/hatchet"],"affectedPackageRefs":["go:github.com/hatchet-dev/hatchet"],"affectedVendors":[],"affectedVendorsRaw":["Hatchet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hatchet cross-tenant task metadata access through GET /api/v1/stable/dags/tasks","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00181,"epssCheckedAt":"2026-11-07T06:14:05.425Z","kevDateAdded":null,"advisoryAliases":["GHSA-55gc-6fmc-fpx9"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:21.877Z","patchAvailable":true,"disclosureDate":"2026-05-14T18:16:47.943Z","fixReleasedAt":"2026-04-23T19:25:39.000Z","daysToFix":-21,"fixCheckedAt":"2026-10-29T21:36:13.784Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/hatchet-dev/hatchet","fixedVersion":"0.83.39","matchedVersion":"v0.83.39","fixReleasedAt":"2026-04-23T19:25:39.000Z","daysToFix":-21,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:36:13.637Z"}]}}