—

GO-2026-6309

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

Quick fix

GO-2026-6309 — github.com/hatchet-dev/hatchet: upgrade to the fixed version with the command below.

go get github.com/hatchet-dev/hatchet@v0.91.2

Details

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hatchet-dev/hatchet

Introduced in: 0.40.0Fixed in: 0.91.2

Fixgo get github.com/hatchet-dev/hatchet@v0.91.2

References

https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-8x7x-83cf-c3pg[ADVISORY]
https://github.com/hatchet-dev/hatchet/commit/591a30deb8b80f02eba7014997de387d710986c9[FIX]