{"id":"CVE-2026-88978","title":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale","summary":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-639","CWE-863"],"vendor":"hatchet-dev","product":"hatchet","affected":["hatchet < 0.106.1"],"published":"2026-09-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:17:26.010","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88978","references":[{"url":"https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85","label":"security-advisories@github.com"},{"url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-21T16:11:47.442Z","slug":"CVE-2026-88978","body":"## Overview\n\nHatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}