Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

hatchet — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in hatchet, with AI-generated Chinese analysis, references, and POCs.

Vendor: hatchet-dev

CVE ID Title CVSS Severity Published
CVE-2026-88978 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter CWE-639 4.3 Medium 2026-09-21
CVE-2026-84298 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CWE-639 3.1 Low 2026-09-21
CVE-2026-61687 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState CWE-287 7.1 High 2026-09-21
CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check CWE-863 6.3 Medium 2026-09-21
CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CWE-918 4.1 Medium 2026-09-21
CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CWE-639 6.4 Medium 2026-08-28
CVE-2026-42572 Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` CWE-639 5.3 Medium 2026-05-14

All 7 known CVE vulnerabilities affecting hatchet with full Chinese analysis, references, and POCs where available.