CVE-2026-84298: Hatchet Privilege Escalation Vulnerability

CVE-2026-84298 Overview

CVE-2026-84298 is a cross-tenant information disclosure vulnerability in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Versions prior to 0.95.3 register worker-supplied task_external_id values in the durableInvocations routing map before verifying tenant ownership. Callback delivery then resolves that map by task UUID without checking tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and holds a stream open on the same dispatcher process can receive that task's durable callback result payload. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated tenant workers can receive durable callback payloads belonging to other tenants sharing the same dispatcher process, exposing sensitive workflow results.

Affected Products

Hatchet versions prior to 0.95.3
Multi-tenant Hatchet deployments running the V1 DurableTask stream handler
Single-tenant Hatchet deployments are not affected in practice

Discovery Timeline

2026-09-21 - CVE-2026-84298 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84298

Vulnerability Analysis

The flaw exists in Hatchet's V1 dispatcher service, which manages durable task callback routing across tenant workers. The dispatcher stores worker-supplied task_external_id values in a shared durableInvocations map keyed only by task UUID. When callbacks arrive, the dispatcher resolves recipients by looking up that UUID without confirming the requesting worker belongs to the task's owning tenant.

Any authenticated worker connected to the same dispatcher process can register itself as a listener for a task UUID belonging to another tenant. If the attacker keeps the gRPC stream open, the dispatcher delivers the durable callback result payload to the attacker's stream. UUIDv4 values are cryptographically random and non-enumerable, which limits opportunistic exploitation but does not eliminate risk when UUIDs leak through logs, telemetry, or shared integrations.

Root Cause

The root cause is missing tenant scoping on the routing key used by the durable invocations map. The dispatcher trusts the task_external_id provided by the worker and does not join it with the calling tenant's identifier before insertion or lookup. This is a textbook Insecure Direct Object Reference where authorization depends on knowledge of an identifier rather than verified ownership.

Attack Vector

Exploitation requires an authenticated tenant account, network access to the dispatcher, and prior knowledge of a target task's UUID. The attacker connects a worker, subscribes to the target UUID on the shared dispatcher process, and waits for the tenant's durable callback to fire. Attack complexity is high because the attacker must obtain the UUID out of band and time the stream to the callback window.

// Patch: internal/services/dispatcher/dispatcher_v1.go
// Introduces a composite key that binds tenantId to taskId

"github.com/hatchet-dev/hatchet/pkg/validator"
)

type durableInvocationsKey struct {
    tenantId uuid.UUID
    taskId   uuid.UUID
}
type DispatcherServiceImpl struct {
    contracts.UnimplementedV1DispatcherServer
    repo               v1.Repository

Source: GitHub Commit 9555bfdd

// Patch: internal/services/dispatcher/dispatcher.go
// Passes task.TenantID into callback delivery so the receiver is scoped

for _, payload := range payloads {
    err := d.serviceV1.DeliverDurableEventLogEntryCompletion(
        task.TenantID,
        payload.TaskExternalId,
        payload.InvocationCount,
        payload.BranchId,

Source: GitHub Commit 9555bfdd

Detection Methods for CVE-2026-84298

Indicators of Compromise

Worker gRPC streams subscribing to task_external_id values that were never issued to their tenant.
Dispatcher log entries showing callback delivery to workers whose tenant ID does not match the originating task's tenant.
Unusually long-lived durable task stream sessions from a single worker spanning many unrelated task UUIDs.

Detection Strategies

Correlate task_external_id values observed in worker subscribe requests against the tenant of the authenticated session at the application layer.
Instrument the dispatcher to emit an audit event whenever a callback is delivered, including both the task tenant ID and the receiving worker's tenant ID for post-hoc review.
Review Hatchet API access logs for tenants enumerating task UUIDs across the control plane.

Monitoring Recommendations

Alert on any callback delivery where the recipient worker's tenant identifier differs from the task's tenant identifier.
Track baseline subscribe rates per worker and flag statistical anomalies in unique task UUIDs subscribed per session.
Forward dispatcher audit logs to a centralized analytics platform for cross-tenant access pattern review.

How to Mitigate CVE-2026-84298

Immediate Actions Required

Upgrade all Hatchet deployments to version 0.95.3 or later, which introduces the tenant-scoped durableInvocationsKey composite key.
Rotate any durable task UUIDs that may have been exposed in shared logs, error reports, or third-party integrations.
Audit multi-tenant dispatcher processes for evidence of unexpected cross-tenant subscriptions since deployment.

Patch Information

The fix is included in Hatchet 0.95.3. The patch introduces a durableInvocationsKey struct that combines tenantId and taskId, and threads task.TenantID into DeliverDurableEventLogEntryCompletion so callback resolution is authoritatively bound to the owning tenant. See the GitHub Security Advisory GHSA-9q4h-f4x5-ffq8 and the remediation commit for full technical details.

Workarounds

Deploy tenant-dedicated dispatcher processes so a compromised worker cannot share a routing map with another tenant.
Restrict distribution of durable task UUIDs and remove them from logs, metrics, and outbound webhooks where possible.
Enforce network segmentation between untrusted tenant workers and dispatcher endpoints until the upgrade is completed.

bash

# Upgrade Hatchet to the patched release
helm repo update
helm upgrade hatchet hatchet/hatchet --version 0.95.3

# Verify the running version
kubectl exec -n hatchet deploy/hatchet-api -- hatchet --version