CVE-2026-54746: Hatchet Auth Bypass Vulnerability

CVE-2026-54746 Overview

CVE-2026-54746 is a cross-tenant authorization flaw in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows. The Dispatcher gRPC service fails to verify that a request's worker ID belongs to the tenant identified by the bearer-token context. This affects the Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe endpoints. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker. The issue is classified as an Insecure Direct Object Reference [CWE-639] and affects Hatchet versions 0.40.0 through 0.91.0.

Critical Impact
Authenticated tenants can modify or disconnect workers belonging to other tenants on shared Hatchet Cloud or multi-tenant self-hosted deployments, resulting in cross-tenant integrity impact and denial of service.

Affected Products

Hatchet versions 0.40.0 through 0.91.0
Hatchet Cloud multi-tenant deployments
Shared self-hosted Hatchet deployments

Discovery Timeline

2026-08-28 - CVE-2026-54746 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-54746

Vulnerability Analysis

The Dispatcher gRPC service in Hatchet accepts a worker UUID from the client and performs operations against it without confirming ownership. The bearer-token context identifies the caller's tenant, but the server never cross-references that tenant against the worker record. This missing check enables a Insecure Direct Object Reference on the WorkerId request field.

Two endpoints are affected. Dispatcher/UpsertWorkerLabels allows an attacker to overwrite affinity labels used for task routing, redirecting or blocking work assignment. Dispatcher/Unsubscribe allows an attacker to forcibly disconnect a foreign tenant's worker from the dispatcher, producing a denial-of-service condition against active workflows.

Single-tenant deployments are not practically affected because the attacker and target tenant are identical. The vulnerability requires only a valid authenticated session against the shared control plane and knowledge or guessing of a target worker's UUID.

Root Cause

The root cause is a missing tenant-scope check in internal/services/dispatcher/server.go. The handlers parsed the WorkerId argument and validated its UUID format, but never called into the workers repository to confirm the worker belonged to tenant.ID derived from the authentication context.

Attack Vector

An attacker authenticates to Hatchet under any tenant they legitimately own. They then issue a gRPC call to Dispatcher/UpsertWorkerLabels or Dispatcher/Unsubscribe with a WorkerId value corresponding to a worker owned by a different tenant. The server processes the request against the target worker without ownership validation.

		return nil, status.Errorf(codes.InvalidArgument, "invalid worker ID format: %s", request.WorkerId)
	}

+	// Confirm the worker belongs to the auth-tenant before mutating its labels.
+	if _, err := s.repov1.Workers().GetWorkerForEngine(ctx, tenant.ID, workerId); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, status.Errorf(codes.NotFound, "worker not found: %s", request.WorkerId)
+		}
+		return nil, err
+	}
+
	_, err = s.upsertLabels(ctx, workerId, request.Labels)

Source: Hatchet security patch commit 591a30d. The patch adds a GetWorkerForEngine lookup keyed by both tenant.ID and workerId, returning NotFound when the worker does not belong to the caller's tenant.

Detection Methods for CVE-2026-54746

Indicators of Compromise

Dispatcher gRPC calls to UpsertWorkerLabels or Unsubscribe where the resolved worker's tenant does not match the calling bearer token's tenant.
Unexpected affinity label changes on workers without a corresponding administrator or CI action from the owning tenant.
Unexplained worker disconnect events followed by workflow scheduling failures on multi-tenant deployments.

Detection Strategies

Enable audit logging on the Dispatcher service and correlate WorkerId values against the authenticated tenant recorded in each gRPC context.
Alert on repeated NotFound responses from Dispatcher/UpsertWorkerLabels or Dispatcher/Unsubscribe after upgrading, which indicate probing for worker UUIDs across tenant boundaries.
Track worker label diffs over time and flag mutations that do not match a known deployment or control-plane action.

Monitoring Recommendations

Monitor gRPC access logs for high-volume enumeration of UUID-formatted WorkerId values from a single tenant principal.
Ship Hatchet dispatcher logs into a centralized analytics platform and build a rule set for cross-tenant identifier mismatches.
Track dispatcher disconnect metrics per tenant to detect anomalous drops that correlate with external API calls.

How to Mitigate CVE-2026-54746

Immediate Actions Required

Upgrade Hatchet to version 0.91.1 or later on all multi-tenant and shared self-hosted deployments.
Rotate tenant API tokens if there is evidence of enumeration against the Dispatcher service.
Audit worker label configurations across tenants and reconcile against expected values before returning to normal operation.

Patch Information

The issue is fixed in Hatchet release v0.91.1. The patch adds a GetWorkerForEngine tenant-scoped lookup before mutating labels or processing unsubscribe requests. Additional context is available in GitHub Security Advisory GHSA-8x7x-83cf-c3pg.

Workarounds

Restrict Dispatcher gRPC exposure to trusted network paths until the upgrade is applied.
Operate affected releases in single-tenant mode only, since the advisory notes single-tenant deployments are not practically affected.
Add an authorization proxy in front of the Dispatcher service that verifies the caller's tenant against the requested WorkerId where feasible.

bash

# Upgrade to the fixed Hatchet release
git clone https://github.com/hatchet-dev/hatchet.git
cd hatchet
git checkout v0.91.1
# Rebuild and redeploy the dispatcher service per your deployment method