Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-21T16:17:24.803Z",
  "pubdate": "2026-09-21T16:17:24.803Z",
  "executiveSummary": "A broken access control vulnerability exists in the Hatchet V1 DurableTask stream handler, prior to version 0.95.3, which allows unauthorized cross-tenant data access.\nThe vulnerability resides in the improper management of the durableInvocations routing map, where task external identifiers are registered before verifying tenant ownership.\nBecause callback delivery resolves this map using only the task UUID without validating the tenant's identity, an authenticated attacker can intercept result payloads from other tenants.\nThe risk is primarily relevant to multi-tenant environments where an attacker has authenticated access to the platform and can predict or otherwise obtain the UUID of a target task.\nSuccessful exploitation allows an attacker to exfiltrate sensitive task execution results belonging to other tenants. Single-tenant deployments are effectively immune to this vulnerability due to the inherent lack of cross-tenant exposure.\nThe issue has been mitigated in version 0.95.3 by enforcing proper tenant-aware validation during the routing and delivery process.",
  "technicalDetails": "The vulnerability originates in the V1 DurableTask stream handler implementation within Hatchet. The system utilizes a durableInvocations routing map to facilitate the delivery of callback results for asynchronous workflows.\nThe root cause is a failure in the architectural enforcement of multi-tenant isolation during the task registration and lookup phase. Specifically, the system processes worker-supplied task_external_id values and populates the durableInvocations routing map prior to performing a mandatory tenant authorization check.\nDuring the callback delivery phase, the handler resolves the intended recipient of a result payload solely by referencing the task UUID within the routing map. Because the resolution mechanism does not perform a secondary verification of the requesting worker's tenant identity against the task's assigned tenant, the system inherently trusts any connection that presents the correct UUID.\nAn attack vector is established when an authenticated tenant-level user maintains an active stream on the same dispatcher process used by the target. If the attacker can ascertain the UUID of a task belonging to a different tenant—typically through observation, logging, or internal reconnaissance—they can monitor or intercept the callback resolution process.\nThe exploitation flow is as follows: 1) The victim tenant initiates a durable task, creating an entry in the global durableInvocations map. 2) The attacker, authenticated within the same infrastructure, monitors the dispatcher stream. 3) The attacker identifies the UUID of the victim's task. 4) The attacker's session, which shares the dispatcher process, exploits the missing tenant-check logic to intercept the callback payload as the system resolves the task UUID. 5) The sensitive result data is delivered to the attacker's stream instead of or in addition to the legitimate consumer.\nWhile the reliance on UUIDv4 provides a degree of protection against brute-force enumeration, the vulnerability represents a significant lapse in internal access control, effectively nullifying the logical boundaries required in multi-tenant SaaS environments.\nThis vulnerability is restricted to versions prior to 0.95.3. The resolution involves patching the handler logic to ensure that tenant context is strictly verified against the task metadata during the resolution of the durableInvocations map, thereby preventing cross-tenant result leakage."
}