---
id: CVE-2026-63342
title: >-
  Hatchet is a platform for orchestrating background tasks, AI agents, and
  durable workflows at scale
summary: >-
  Hatchet is a platform for orchestrating background tasks, AI agents, and
  durable workflows at scale. Prior to 0.91.1,
  api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET
  /api/v1/stable/durable-tasks/{durable-ta…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-863
vendor: hatchet-dev
product: hatchet
affected:
  - hatchet < 0.91.1
patched:
  - github.com/hatchet-dev/hatchet 0.91.1
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:26:49.087'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63342'
references:
  - url: >-
      https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb
    label: security-advisories@github.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63342'
  - url: 'https://github.com/advisories/GHSA-g26x-m427-f48f'
  - url: 'https://github.com/hatchet-dev/hatchet'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00314
epssPercentile: 0.21738
aliases:
  - GHSA-g26x-m427-f48f
ecosystem: go
ingestedAt: '2026-09-21T16:11:47.445Z'
---

## Overview

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63342)

Affected packages:

- `github.com/hatchet-dev/hatchet < 0.91.1`

Patched in:

- `github.com/hatchet-dev/hatchet 0.91.1`

Source: https://github.com/advisories/GHSA-g26x-m427-f48f