Hatchet Security Update Addresses 4 Vulnerabilities
Tech GuruQuick Answer
Four Hatchet advisories cover an SNS request-forgery path and three cross-tenant durable-task disclosures. The latter require an authenticated tenant or worker and knowledge of another tenant's task identifier. Check all four fixes when upgrading; the sources disagree on some older version boundaries, as detailed below.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Hatchet server versions, SNS integration and multi-tenant worker/dispatcher use. Plan a supported upgrade that includes all four fixes and confirm ambiguous older-version coverage with the maintainer.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Hatchet packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-fjwv-jf2v-j499 / GHSA-g26x-m427-f48f / GHSA-9q4h-f4x5-ffq8 / GHSA-992g-9cr3-vm5x |
| CVEs | CVE-2026-61681, CVE-2026-63342, CVE-2026-84298, CVE-2026-88978 |
| Project advisory publication | 2026-06-30 and 2026-09-04 (four project advisories) |
| Recorded source timestamp (historical snapshot) | 2026-09-22 20:40:48 UTC |
| Affected versions | The CNA ranges are before 0.91.1 for CVE-2026-61681 and CVE-2026-63342, before 0.95.3 for CVE-2026-84298, and before 0.106.1 for CVE-2026-88978. GHSA range fields differ for the first three; do not use those inconsistencies to declare an older deployment unaffected. |
| Fixed version | Project GHSA targets: 0.91.2 for CVE-2026-61681 and CVE-2026-63342; 0.95.3 for CVE-2026-84298; 0.106.1 for CVE-2026-88978. The first two CNA records instead name 0.91.1. Confirm all fixes in the supported target build rather than relying on the conflicting older boundary. |
| CVSS base score | 3.1 / 4.1 / 4.3 / 6.3 (CVSS v3) |
| CVSS severity | Low to Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-61681 concerns an SNS UnsubscribeConfirmation handler. An authenticated Hatchet tenant with a valid AWS-signed message can change its unsigned UnsubscribeURL, causing a server-side request. Impact depends on the destinations reachable by the Hatchet server; the advisory does not establish that every deployment exposes cloud credentials.
CVE-2026-63342 lets an authenticated user who knows another tenant's durable-task UUID read its event logs through a missing authorization check. CVE-2026-84298 concerns callback registration before ownership validation: an authenticated worker with the foreign UUID must keep its stream open on the same dispatcher process to receive that task's callback payload.
CVE-2026-88978 affects WorkerStatus gRPC lookups. An authenticated worker can supply known foreign task identifiers to a query that lacks a tenant filter, exposing matching event records. It is distinct from the dispatcher callback path and requires its own fix.
What To Validate Now
- Inventory. Locate Hatchet packages and release streams identified in the project advisories deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Assess SNS callback handling separately from tenant isolation. For the durable-task flaws, identify authenticated tenant/worker access and whether another tenant's UUID could be learned; the dispatcher callback issue additionally requires the same dispatcher process.
- Remediate. Use a supported server build containing all four fixes, including the WorkerStatus fix first identified in 0.106.1. Reconcile the 0.91.1/0.91.2 discrepancy with the maintainer if maintaining an older branch; update all relevant server and dispatcher instances.
- Validate. In an isolated two-tenant test, verify event logs, callbacks and WorkerStatus results stay within the requesting tenant. Use a controlled SNS callback destination to verify request restrictions, then check legitimate workflows. These tests were not performed here.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The three cross-tenant flaws require a victim task UUID; the project notes that UUIDv4 identifiers are not practically enumerable and that the worker disclosure issues do not affect single-tenant deployments in practice. Those limits do not remove the separate SNS risk. Preserve logs when investigating possible prior disclosure.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
