github.com/hatchet-dev/hatchet
Go7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/hatchet-dev/hatchetpage 1 of 1
- CVE-2026-42572MEDIUMCVSS 5.3EG 5.3fixed in 0.83.392026-05-14
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check…
- CVE-2026-54746MEDIUMCVSS 6.4EG 6.4fixed in 0.91.22026-08-28
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the b…
- CVE-2026-61681MEDIUMCVSS 4.1EG 4.12026-09-21
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.Unsubsc…
- CVE-2026-61687HIGHCVSS 7.1EG 7.12026-09-21
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later a…
- CVE-2026-63342MEDIUMCVSS 6.3EG 6.3fixed in 0.91.12026-09-21
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task…
- CVE-2026-84298LOWCVSS 3.1EG 3.1fixed in 0.95.32026-09-21
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map be…
- CVE-2026-88978MEDIUMCVSS 4.3EG 4.3fixed in 0.106.12026-09-21
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and br…
Check whether github.com/hatchet-dev/hatchet is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/hatchet-dev/hatchet CVEs against the assets you own.
Book a Demo →