CVE-2026-84298 in Hatchet
Summary
by MITRE • 09/21/2026
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within the Hatchet platform prior to version 0.95.3 represents a critical logic flaw in the handling of durable task invocations, specifically affecting multi-tenant deployments where tenant isolation is paramount for security and data privacy. Hatchet serves as an orchestration layer for background tasks, AI agents, and durable workflows at scale, relying on strict separation between tenants to ensure that one customer's operations do not interfere with or expose the state of another. The core issue stems from a race condition-like logic error in the V1 DurableTask stream handler, which manages how worker-supplied task identifiers are processed before they are routed for execution and callback delivery.
The technical flaw occurs during the initialization phase of a durable task invocation. When a tenant's worker initiates a task, it supplies an external identifier known as task_external_id. The system stores this mapping in a routing map called durableInvocations to facilitate future lookups when callbacks need to be delivered back to the correct client. However, the implementation fails to verify that the current request context belongs to the same tenant associated with the target task before inserting or resolving entries in this shared state structure. This means that the system prioritizes operational continuity over security validation during the initial setup of the stream handler, creating a window where cross-tenant data access is possible under specific conditions.
The exploitation scenario requires an authenticated attacker who operates as a legitimate tenant worker within the same multi-tenancy environment. To successfully exploit this vulnerability, the attacker must possess knowledge of another tenant's durable task UUID, which serves as the primary key for resolving callback results in the backend system. While UUIDv4 values are generally considered non-enumerable due to their high entropy and random generation, making it difficult to guess valid targets blindly, an attacker might obtain these identifiers through other means such as log leakage, API response inspection, or side-channel information if available. Once a target task is identified, the attacker must maintain an open stream connection on the same dispatcher process that handles the victim's tasks. By doing so, the attacker can intercept and receive the durable callback result payload intended for the legitimate tenant worker.
The operational impact of this vulnerability is significant in multi-tenant SaaS environments where Hatchet is deployed. It allows for unauthorized data exfiltration by enabling one tenant to read sensitive execution results generated by another tenant's workflows. These payloads may contain proprietary business logic outcomes, personally identifiable information processed during AI agent operations, or other confidential state changes that were never intended to be visible outside the authorized tenant boundary. This constitutes a direct violation of confidentiality and breaks the fundamental isolation guarantees expected in multi-tenant architectures. Although single-tenant deployments are not affected because there is no concept of cross-tenant identity verification required for security, any organization relying on Hatchet's multi-tenancy features faces potential data breaches if they do not upgrade promptly.
This vulnerability aligns with CWE Category 284, which covers Improper Access Control, specifically reflecting failures in enforcing proper authorization checks before accessing shared resources or state. Furthermore, it relates to CWE 367, Time-of-check Time-of-use (TOCTOU) race conditions, as the system fails to maintain consistent security context between the initial task registration and subsequent callback resolution phases. From an ATT&CK perspective, this behavior facilitates Data Exfiltration over a Command and Control channel or via Application Layer Protocol, allowing adversaries to harvest sensitive data from compromised systems by leveraging legitimate administrative interfaces without triggering typical intrusion detection alerts associated with external network exfiltration tools.
The recommended mitigation is straightforward but urgent for affected deployments: organizations must upgrade the Hatchet platform to version 0.95.3 or later immediately upon availability. This release corrects the logic in the V1 DurableTask stream handler by ensuring that tenant ownership and identity are strictly verified before any task_external_id values are stored in the durableInvocations routing map. Additionally, callback delivery mechanisms have been updated to resolve maps using both the task UUID and the authenticated tenant identity, thereby preventing cross-tenant resolution even if an attacker possesses a valid target UUID. Until this patch is applied, administrators should monitor for unusual patterns of stream connections from worker processes that do not correspond to expected workload distributions, although such detection may be challenging without comprehensive audit logging enabled on the dispatcher layer.