Hatchet CVE-2026-63342

Requires an authenticated Hatchet account (PR:L) AND prior knowledge of a specific durable-task UUID belonging to a different tenant - the 128-bit UUID is not guessable and must be obtained out-of-band (leaked logs, shared references, error messages, cross-tenant integrations). Only Hatchet deployments prior to version 0.91.1 running the multi-tenant durable-tasks API are affected; the vulnerable endpoint is GET /api/v1/stable/durable-tasks/{durable-task} (listDurableEventLog). What limits exploitation: the need for a valid foreign UUID (attack complexity high), the requirement to already hold valid credentials, and the read-only nature of the endpoint (no write/integrity or availability impact). Single-tenant or upgraded (>=0.91.1) deployments are not exposed.

This is a genuine but moderate-severity cross-tenant authorization flaw (CWE-863 / IDOR), not a critical drop-everything issue. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N = 6.3) is internally consistent with the description and the commit evidence: exploitation is network-reachable but requires an authenticated account (PR:L) and, critically, prior knowledge of another tenant's durable-task UUID - a 128-bit unguessable identifier - which correctly justifies AC:H. The scope change (S:C) reflects that a user authenticated to their own tenant reads data belonging to a different security authority (another tenant), and impact is confidentiality-only (I:N/A:N) since the endpoint is a read-only event-log GET. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here: all indicators point to a real-but-conditional bug whose main mitigating factor is the need to first obtain an out-of-band UUID, making opportunistic mass exploitation unlikely and targeted exploitation the realistic threat model. The fix is confirmed by the linked commit (06c1fe43), which re-scopes the route under /tenants/{tenant}/ and adds a 403 when the resource's parent does not match the URL tenant.

An attacker with a valid Hatchet account on one tenant obtains a durable-task UUID belonging to a different tenant (e.g., via logs, a shared integration, a leaked reference, or error output) and issues an authenticated GET to /api/v1/stable/durable-tasks/{durable-task}. Because the pre-0.91.1 route did not require the tenant as a parent resource, the server returns the foreign task's event log - exposing task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing. No public POC is identified, and the high attack complexity (needing a valid foreign UUID) means this favors targeted rather than opportunistic abuse.