Vulnerability GO-2026-6561
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
6 hours ago
October 01, 2026 at 08:23 PM UTC
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet
v0.0.0 - v0.95.2
v0.0.0 - v0.95.2
Summary
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet
Details
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
6 hours ago
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet
v0.0.0 - v0.106.0 GO-2026-6560
v0.0.0 - v0.106.0 GO-2026-6560
Unknown
6 hours ago
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet
v0.0.0 - v0.109.21-alpha.0 GO-2026-6565
v0.0.0 - v0.109.21-alpha.0 GO-2026-6565
Unknown
6 hours ago
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet
v0.0.0 - v0.91.0 GO-2026-6567
v0.0.0 - v0.91.0 GO-2026-6567
Unknown
3 days ago
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState in hatchet in github.com/hatchet-dev/hatchet
v0.0.0 - v0.109.21-alpha.0 GO-2026-6535
v0.0.0 - v0.109.21-alpha.0 GO-2026-6535
Medium Risk
9 days ago
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
v0.0.0 - v0.106.0 GHSA-992g-9cr3-vm5x
v0.0.0 - v0.106.0 GHSA-992g-9cr3-vm5x
Impacted packages
Timeline
Published
6 hours ago
October 01, 2026 at 08:23 PM UTC
Last Modified
6 hours ago
October 01, 2026 at 08:45 PM UTC