CVE-2026-84298

Katalog CVE

CVSS 3.1 · Low EPSS 0,24%

Kerentanan Authorization Bypass Through User-Controlled Key. Skor CVSS 3.1 3.1 (Low) menurut github.com.

Deskripsi (NVD)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.

Rincian

Terbit di NVD

21 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

3.1 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862: Missing Authorization

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/hatchet-dev/hatchet/commit/9555bfdd1e97f61d25e614ccaa107c5fb7dc4976
• https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-9q4h-f4x5-ffq8