CVE-2026-42572 PUBLISHED

Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

Assigner: GitHub_M
Reserved: 28.04.2026 Published: 14.05.2026 Updated: 14.05.2026

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor hatchet-dev
Product hatchet
Versions
  • Version < 0.83.38 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE
  • CWE-863: Incorrect Authorization CWE