github.com/hatchet-dev/hatchet vulnerabilities (Go)

7 vulnerabilities.

• github.com/hatchet-dev/hatchet Go Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter CVE-2026-88978 Fix available 4.3 MediumSeptember 21, 2026
• github.com/hatchet-dev/hatchet Go Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVE-2026-84298 Fix available 3.1 LowSeptember 21, 2026
• github.com/hatchet-dev/hatchet Go hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState CVE-2026-61687 Fix available 7.1 HighSeptember 21, 2026
• github.com/hatchet-dev/hatchet Go Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check CVE-2026-63342 Fix available 6.3 MediumSeptember 21, 2026
• github.com/hatchet-dev/hatchet Go Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CVE-2026-61681 Fix available 4.1 MediumSeptember 21, 2026
• github.com/hatchet-dev/hatchet Go Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVE-2026-54746 Fix available 6.4 MediumAugust 28, 2026
• github.com/hatchet-dev/hatchet Go Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` CVE-2026-42572 Fix available 5.3 MediumMay 6, 2026