MEDIUM4.3

GO-2026-6560

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Quick fix

GO-2026-6560 — github.com/hatchet-dev/hatchet: upgrade to the fixed version with the command below.

go get github.com/hatchet-dev/hatchet@v0.106.1

Details

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hatchet-dev/hatchet

Introduced in: 0Fixed in: 0.106.1

Fixgo get github.com/hatchet-dev/hatchet@v0.106.1

References

https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x[ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-88978[ADVISORY]
https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85[FIX]