CVE-2026-63342: Hatchet durable task event log readable across tenants by UUID

Summary

Hatchet, a platform for orchestrating background tasks, AI agents and durable workflows, has a flaw prior to 0.91.1. The GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not require the target tenant as a parent resource. An authenticated user who obtains another tenant's durable task UUID can read that task's event log, which can expose task display names, workflow identifiers, user messages, wait conditions, branching logic and timing information.

Mitigation

Fixed in 0.91.1.

Topics

• AI agents

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News