{"id":"GHSA-992g-9cr3-vm5x","summary":"Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter","details":"# Cross-tenant disclosure risk on `DurableTask` bidi RPC\n\nThis is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via the `handleWorkerStatus` polling path.\n\n# Impact\n\nThis advisory requires an attacker to successfully guess a durable task's external uuid belonging to another tenant. External ids are generated uuid v4s (`uuid.New()` in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.\n\n### Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:\n\n* Hatchet Cloud (multi-tenant SaaS)\n* Self-hosted Hatchet with multiple internal teams / business units sharing one instance\n* Any deployment where a single tenant's API token can be obtained by an attacker\n\nSingle-tenant self-hosted deployments are unaffected in practice (the \"victim\" and \"attacker\" tenants would be the same).","aliases":["CVE-2026-88978"],"modified":"2026-09-22T21:00:04.740729106Z","published":"2026-09-22T20:40:46Z","database_specific":{"cwe_ids":["CWE-639","CWE-863"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-22T20:40:46Z","nvd_published_at":"2026-09-21T16:17:26Z"},"references":[{"type":"WEB","url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88978"},{"type":"WEB","url":"https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85"},{"type":"PACKAGE","url":"https://github.com/hatchet-dev/hatchet"}],"affected":[{"package":{"name":"github.com/hatchet-dev/hatchet","ecosystem":"Go","purl":"pkg:golang/github.com/hatchet-dev/hatchet"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.106.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-992g-9cr3-vm5x/GHSA-992g-9cr3-vm5x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}