{"data":{"id":"e6b219dd-9e38-4251-8362-e2db9ac2f1a7","title":"CVE-2026-63342: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1…","summary":"Hatchet, a platform for orchestrating background tasks, AI agents and durable workflows, has a flaw prior to 0.91.1. The GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not require the target tenant as a parent resource. An authenticated user who obtains another tenant's durable task UUID can read that task's event log, which can expose task display names, workflow identifiers, user messages, wait conditions, branching logic and timing information.","solution":"Fixed in 0.91.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63342","publishedAt":"2026-09-21T16:17:10.737Z","cveId":"CVE-2026-63342","cweIds":["CWE-863"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/hatchet-dev/hatchet@< 0.91.1 (fixed: 0.91.1)"],"affectedPackageNames":["github.com/hatchet-dev/hatchet"],"affectedPackageRefs":["go:github.com/hatchet-dev/hatchet"],"affectedVendors":[],"affectedVendorsRaw":["Hatchet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hatchet durable task event log readable across tenants by UUID","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00314,"epssCheckedAt":"2026-11-10T06:09:41.263Z","kevDateAdded":null,"advisoryAliases":["GHSA-g26x-m427-f48f"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:27.526Z","patchAvailable":true,"disclosureDate":"2026-09-21T16:17:10.737Z","fixReleasedAt":"2026-06-30T14:50:02.000Z","daysToFix":-83,"fixCheckedAt":"2026-10-29T21:30:25.075Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/hatchet-dev/hatchet","fixedVersion":"0.91.1","matchedVersion":"v0.91.1","fixReleasedAt":"2026-06-30T14:50:02.000Z","daysToFix":-83,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:24.929Z"}]}}