hatchet-dev hatchet vulnerabilities

Newest CVEs

• CVE-2026-108755

  Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

  hatchet-dev · hatchet

  Medium6.9
• CVE-2026-88978

  Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

  hatchet-dev · hatchet

  Medium4.3
• CVE-2026-84298

  Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

  hatchet-dev · hatchet

  Low3.1
• CVE-2026-61687

  hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

  hatchet-dev · hatchet

  High7.1
• CVE-2026-63342

  Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

  hatchet-dev · hatchet

  Medium6.3
• CVE-2026-61681

  Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

  hatchet-dev · hatchet

  Medium4.1
• CVE-2026-54746

  Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

  hatchet-dev · hatchet

  Medium6.4
• CVE-2026-42572

  Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

  hatchet-dev · hatchet

  Medium5.3