Skip to content
AI Sec Watch
MediumVulnerability

CVE-2026-42572: Hatchet cross-tenant task metadata access through GET /api/v1/stable/dags/tasks

Source
NVD(opens in a new tab)
Identifier
CVE-2026-42572
Published
Record updated
View JSON
Affected
  • github.com/hatchet-dev/hatchet <= 0.83.38
Fixed in
0.83.39
  • released April 23, 2026, 21 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.2%

Summary

CVE-2026-42572 affects Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, prior to 0.83.39. A missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint skipped the tenant-membership check, so a user authenticated to any tenant on the same instance could supply another tenant's UUID and a DAG UUID from that tenant and receive that DAG's task metadata.

Mitigation

Fixed in 0.83.39.

Topics