CVE-2026-88978: Multi-Tenant Isolation Failure in Hatchet Durable Workflow Engine
Vulnerability ID: CVE-2026-88978
CVSS Score: 4.3
Published: 2026-09-22
CVE-2026-88978 is a critical cross-tenant data exposure vulnerability in Hatchet, a platform for orchestrating background tasks and durable workflows. The flaw exists in the durable-task event retrieval system where client-supplied task, node, and branch UUIDs are resolved via the ListSatisfiedEntries database query without verifying the tenant ownership of the requesting worker context.
TL;DR
Hatchet fails to restrict durable event log queries to the caller's tenant ID, allowing authenticated workers to view task metadata from other tenants if the target task UUID is known.
Technical Details
- CWE ID: CWE-639 / CWE-863
- Attack Vector: Network (gRPC)
- CVSS Score: 4.3 (Medium)
- Exploit Status: None (No public exploit available)
- KEV Status: Not Listed
- Impact: Cross-tenant data exposure
Affected Systems
- Hatchet Control Plane
- Hatchet Durable Event Logging System
Mitigation Strategies
- Upgrade Hatchet control plane and worker engines to version 0.106.1 or later.
- Enforce context-bound tenant filters at the database engine level for all shared tables.
- Restrict the output of workflow UUIDs in application logs, external error reports, and client-facing telemetry.
Remediation Steps:
- Identify all active control plane instances within the multi-tenant deployment.
- Pull the official release tag v0.106.1 or higher from the repository.
- Run database migrations to ensure the updated PostgreSQL query layouts are applied.
- Verify that gRPC services are restarted and validating the updated client schemas.
References
Read the full report for CVE-2026-88978 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)