EUVD-2026-67791
GHSA-8x7x-83cf-c3pg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
UUID guessing raises AC to H; PR:L for required tenant token; S:C reflects cross-tenant impact; no confidentiality exposure confirmed.
Primary rating from Vendor (https://github.com/hatchet-dev/hatchet).
CVSS VectorVendor: https://github.com/hatchet-dev/hatchet
Lifecycle Timeline
2DescriptionCVE.org
Summary
A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token (the lowest credential Hatchet issues - an OWNER of a brand-new tenant) to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UUID belonging to any other tenant on the same Hatchet instance. The two affected RPCs - Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe - read the caller's tenant from the bearer-token context only for analytics and response shaping, and never use it to authorise the worker_id from the request body.
Impact
This CVE requires the attacker to successfully guess the target UUID. Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:
- Hatchet Cloud (multi-tenant SaaS) - every tenant is exposed to every other tenant.
- Self-hosted Hatchet with multiple internal teams / business units sharing one instance - each team is exposed to every other team on the box.
- Any deployment where a single tenant's API token can be obtained by an attacker (e.g. a leaked low-privilege CI token from a single tenant). One token is enough to attack every other tenant on the same instance.
Single-tenant self-hosted deployments are unaffected in practice (the "victim" and "attacker" tenants would be the same).
AnalysisAI
Cross-tenant authorization bypass in Hatchet's Dispatcher gRPC service (versions 0.40.0 through 0.91.1) permits any authenticated low-privilege tenant to overwrite worker affinity labels or force-disconnect workers belonging to other tenants on the same instance. The two affected RPCs - UpsertWorkerLabels and Unsubscribe - validate the caller's bearer token only for analytics and response shaping, never to authorize the worker_id supplied in the request body, constituting a classic IDOR (CWE-639) across tenant boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid tenant-scoped API token on the same Hatchet instance as the target - this is the lowest credential Hatchet issues and can belong to a brand-new, otherwise-empty tenant. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 6.4 (Medium) with S:C correctly captures the cross-tenant blast radius, but real-world risk is constrained by two factors the raw score does not fully reflect: the attacker must hold a valid tenant API token (PR:L eliminates unauthenticated exploitation) and must successfully guess or otherwise obtain a victim worker UUID, which is a meaningful probabilistic barrier for randomly-generated UUIDs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Hatchet to version 0.91.2 or later, which contains the patch commit 591a30deb8b80f02eba7014997de387d710986c9 (https://github.com/hatchet-dev/hatchet/commit/591a30deb8b80f02eba7014997de387d710986c9). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today