https://vulnerability.circl.lu/sightings/feed 2026-09-24T03:19:44.436710+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/2a1e6b85-7cec-4ae3-a950-aa9e725265c6/export 2026-09-24T03:19:44.458529+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2a1e6b85-7cec-4ae3-a950-aa9e725265c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88978", "type": "seen", "source": "https://gist.github.com/alon710/7fc7905eeee7b3e580e11b9e78f8548b", "content": "# CVE-2026-88978: CVE-2026-88978: Multi-Tenant Isolation Failure in Hatchet Durable Workflow Engine\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88978\n\n## Summary\nCVE-2026-88978 is a critical cross-tenant data exposure vulnerability in Hatchet, a platform for orchestrating background tasks and durable workflows. The flaw exists in the durable-task event retrieval system where client-supplied task, node, and branch UUIDs are resolved via the ListSatisfiedEntries database query without verifying the tenant ownership of the requesting worker context.\n\n## TL;DR\nHatchet fails to restrict durable event log queries to the caller's tenant ID, allowing authenticated workers to view task metadata from other tenants if the target task UUID is known.\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-863\n- **Attack Vector**: Network (gRPC)\n- **CVSS Score**: 4.3 (Medium)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n- **Impact**: Cross-tenant data exposure\n\n## Affected Systems\n\n- Hatchet Control Plane\n- Hatchet Durable Event Logging System\n\n## Mitigation\n\n- Upgrade Hatchet control plane and worker engines to version 0.106.1 or later.\n- Enforce context-bound tenant filters at the database engine level for all shared tables.\n- Restrict the output of workflow UUIDs in application logs, external error reports, and client-facing telemetry.\n\n**Remediation Steps:**\n1. Identify all active control plane instances within the multi-tenant deployment.\n2. Pull the official release tag v0.106.1 or higher from the repository.\n3. Run database migrations to ensure the updated PostgreSQL query layouts are applied.\n4. Verify that gRPC services are restarted and validating the updated client schemas.\n\n## References\n\n- [GitHub Security Advisory GHSA-992g-9cr3-vm5x](https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x)\n- [Fix Commit 15bc792](https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85)\n- [CVE-2026-88978 Record](https://www.cve.org/CVERecord?id=CVE-2026-88978)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88978) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T00:32:28.110152Z"} 2026-09-23T00:32:28.110152+00:00