CVE-2026-63342: Hatchet Information Disclosure Vulnerability

CVE-2026-63342 Overview

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. CVE-2026-63342 is a broken access control vulnerability [CWE-863] affecting Hatchet versions prior to 0.91.1. The GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not require the target tenant as a parent resource. An authenticated user who obtains another tenant's durable task UUID can read that task's event log across tenant boundaries. The issue is fixed in version 0.91.1.

Critical Impact
Cross-tenant data exposure of durable task event logs, including task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information.

Affected Products

Hatchet versions prior to 0.91.1
api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml endpoint definitions
Deployments exposing the listDurableEventLog handler

Discovery Timeline

2026-09-21 - CVE-2026-63342 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-63342

Vulnerability Analysis

The vulnerability resides in Hatchet's OpenAPI route definition for durable task event log retrieval. The route GET /api/v1/stable/durable-tasks/{durable-task} accepts a durable task UUID directly without scoping the request to a parent tenant path segment. When the middleware populator resolves the resource, it does not verify that the requesting user's tenant matches the tenant that owns the referenced durable task.

Any authenticated user who acquires another tenant's durable task UUID can invoke the endpoint and receive the event log payload. Disclosed data spans task display names, workflow identifiers, user messages, wait conditions, branching logic, and execution timing. The exposure enables reconnaissance of another tenant's workflow topology and business logic.

Root Cause

The root cause is a missing authorization check tied to the URL structure. Because the resource path lacks a {tenant} parent segment, the populator middleware treats the durable task as a top-level resource. Ownership validation is not enforced, permitting horizontal privilege escalation across tenants.

Attack Vector

Exploitation requires a valid authenticated session on any tenant and knowledge or discovery of a target durable task UUID. The attacker issues an HTTP GET to the vulnerable path and receives the cross-tenant event log in the response.

// Security patch in api/v1/server/middleware/populator/populator.go
// Source: https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb

				populated = true
			} else if populated && child.ParentID != node.ResourceID {
-				// if the parent ID is not the same as the resource ID, throw an error
-				return fmt.Errorf("resource %s could not be populated", node.ResourceKey)
+				// the child belongs to a different parent than the one in the URL — unauthorized
+				return echo.NewHTTPError(http.StatusForbidden, "not authorized to access this resource")
			}
		}
	}

The fix also re-scopes the route under the tenant path, as shown in the generated API client:

typescript

// Source: https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb

   * @tags Durable Tasks
   * @name V1DurableTaskEventLogList
   * @summary List durable event log
-  * @request GET:/api/v1/stable/durable-tasks/{durable-task}
+  * @request GET:/api/v1/stable/tenants/{tenant}/durable-tasks/{durable-task}
   * @secure
   */
  v1DurableTaskEventLogList = Object.assign((
+    tenant: string,
     durableTask: string,

Detection Methods for CVE-2026-63342

Indicators of Compromise

Requests to GET /api/v1/stable/durable-tasks/{durable-task} where the responding tenant context differs from the caller's tenant.
Authenticated sessions issuing sequential or enumerated UUID lookups against the durable tasks endpoint.
Elevated volume of successful 200 responses on the legacy unscoped path after the 0.91.1 route change.

Detection Strategies

Parse Hatchet API access logs for hits on the unscoped /api/v1/stable/durable-tasks/ path and correlate the requester's tenant with the resolved resource owner.
Alert when a single authenticated principal accesses durable task UUIDs mapped to more than one tenant within a short window.
Compare application audit logs against populator middleware decisions to surface authorization gaps.

Monitoring Recommendations

Forward Hatchet API and middleware logs to a centralized analytics platform for cross-tenant access review.
Baseline normal durable task read patterns per tenant and flag deviations.
Retain full request URI, authenticated principal, and tenant identifiers to support forensic reconstruction.

How to Mitigate CVE-2026-63342

Immediate Actions Required

Upgrade Hatchet to version 0.91.1 or later, which enforces tenant scoping on the durable task event log endpoint.
Audit historical API logs for unscoped requests to /api/v1/stable/durable-tasks/{durable-task} and investigate any cross-tenant access.
Rotate durable task UUIDs or invalidate cached identifiers that may have been exposed to untrusted authenticated users.

Patch Information

The fix is delivered in Hatchet 0.91.1 via commit 06c1fe43543e853ea98ecc2e6a575e2b8310bbeb. The patch re-scopes the route to /api/v1/stable/tenants/{tenant}/durable-tasks/{durable-task} and updates the populator middleware to return HTTP 403 when a child resource's parent does not match the tenant in the URL. See the GitHub Security Advisory GHSA-g26x-m427-f48f for details.

Workarounds

Restrict network access to the Hatchet API so that only trusted tenants can authenticate.
Place a reverse proxy or API gateway in front of Hatchet that rejects requests to the unscoped /api/v1/stable/durable-tasks/ path until the upgrade is completed.
Reduce the lifetime and distribution of durable task UUIDs to limit the window for enumeration.

bash

# Reverse-proxy example: block the vulnerable unscoped route until upgrade
location ~ ^/api/v1/stable/durable-tasks/ {
    return 403;
}