---
id: CVE-2026-88978
title: >-
  Hatchet is a platform for orchestrating background tasks, AI agents, and
  durable workflows at scale
summary: >-
  Hatchet is a platform for orchestrating background tasks, AI agents, and
  durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling
  path in pkg/repository/durable_events.go passes caller-supplied durable task,
  node, and …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
  - CWE-863
vendor: hatchet-dev
product: hatchet
affected:
  - hatchet < 0.106.1
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T16:17:26.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88978'
references:
  - url: >-
      https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85
    label: security-advisories@github.com
  - url: >-
      https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-21T16:11:47.442Z'
---

## Overview

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.