GHSA-g26x-m427-f48f
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Quick fix
GHSA-g26x-m427-f48f — github.com/hatchet-dev/hatchet: upgrade to the fixed version with the command below.
go get github.com/hatchet-dev/hatchet@v0.91.1Details
### Summary
The `GET /api/v1/stable/durable-tasks/{durable-task}` endpoint (`listDurableEventLog`) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.
### Impact This CVE requires the attacker to successfully guess the target UUID. Any authenticated Hatchet user can read durable task event logs from any other tenant, exposing: - Task display names and workflow identifiers - User messages (may contain sensitive business data) - Wait conditions and branching logic - Timing information
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 0.91.1go get github.com/hatchet-dev/hatchet@v0.91.1