hatchet-dev has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-639 (3). Most affected products: hatchet (5), github.com/hatchet-dev/hatchet (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- hatchet 5
- github.com/hatchet-dev/hatchet 1
Worst active — by depth score
CVE-2026-61687High· 7.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale39CVE-2026-63342Medium· 6.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale35CVE-2026-54746Medium· 6.4Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale35CVE-2026-88978Medium· 4.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale24CVE-2026-61681Medium· 4.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale23
hatchet-dev vulnerabilities
CVEs affecting hatchet-dev, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-61681Medium· 4.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.Unsub…
CVE-2026-63342Medium· 6.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-ta…
CVE-2026-84298Low· 3.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map …
CVE-2026-88978Medium· 4.3Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and …
CVE-2026-61687High· 7.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later…
CVE-2026-54746Medium· 6.4Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the…