CVE-2026-42572

Katalog CVE

CVSS 6.5 · Medium EPSS 0,29%

Kerentanan Authorization Bypass Through User-Controlled Key pada hatchet. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.

Rincian

Terbit di NVD

14 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9 mitigasi · advisory vendor