hatchet-dev hatchet up to 0.83.37 tasks authorization

Summaryinfo

A vulnerability, which was classified as problematic, was found in hatchet-dev hatchet up to 0.83.37. Affected by this vulnerability is an unknown functionality of the file /api/v1/stable/dags/tasks. Executing a manipulation can lead to authorization. This vulnerability is handled as CVE-2026-42572. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in hatchet-dev hatchet up to 0.83.37 and classified as problematic. This vulnerability affects some unknown functionality of the file /api/v1/stable/dags/tasks. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality. CVE summarizes:

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.

The advisory is available at github.com. This vulnerability was named CVE-2026-42572 since 04/28/2026. The exploitation appears to be difficult. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 0.83.38 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• hatchet-dev

Name

• hatchet

Version

• 0.83.0
• 0.83.1
• 0.83.2
• 0.83.3
• 0.83.4
• 0.83.5
• 0.83.6
• 0.83.7
• 0.83.8
• 0.83.9
• 0.83.10
• 0.83.11
• 0.83.12
• 0.83.13
• 0.83.14
• 0.83.15
• 0.83.16
• 0.83.17
• 0.83.18
• 0.83.19
• 0.83.20
• 0.83.21
• 0.83.22
• 0.83.23
• 0.83.24
• 0.83.25
• 0.83.26
• 0.83.27
• 0.83.28
• 0.83.29
• 0.83.30
• 0.83.31
• 0.83.32
• 0.83.33
• 0.83.34
• 0.83.35
• 0.83.36
• 0.83.37

Website

• Product: https://github.com/hatchet-dev/hatchet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion