Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/hatchet-dev/hatchet

7 known vulnerabilities (1 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 5 medium, 1 low
Registry
pkg.go.dev

Advisories 7

  • CVE-2026-88978Medium 4.3

    Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

    Affected: fixed in 0.106.1.

  • Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

    Affected: fixed in 0.95.3.

  • hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

    Affected: fixed in 0.91.1.

  • CVE-2026-63342Medium 6.3

    Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

    Affected: fixed in 0.91.1.

  • CVE-2026-61681Medium 4.1

    Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

    Affected: fixed in 0.91.1; fixed in 0.91.2.

  • CVE-2026-54746Medium 6.4

    Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

    Affected: from 0.40.0, fixed in 0.91.2.

  • CVE-2026-42572Medium 5.3

    Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

    Affected: fixed in 0.83.39.