Go/github.com/hatchet-dev/hatchet

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`

Modified: 6/25/2026

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Modified: 9/2/2026

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

Modified: 10/1/2026

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Modified: 10/1/2026

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Modified: 10/1/2026

Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds` in github.com/hatchet-dev/hatchet

Modified: 6/25/2026

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

Modified: 9/2/2026

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

Modified: 10/7/2026

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Modified: 10/1/2026

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet

Modified: 10/1/2026

SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet

Modified: 10/7/2026

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet

Modified: 10/1/2026