CVE-2026-84298: Cross-Tenant Authorization Bypass and Information Disclosure in Hatchet V1 Dispatcher

Vulnerability ID: CVE-2026-84298
CVSS Score: 3.1
Published: 2026-09-22

Hatchet V1 Dispatcher before version 0.95.3 fails to enforce proper tenant boundaries when managing active stream connections for durable task completions. Because the global lookup map is keyed solely by task external identifiers, authenticated attackers who obtain a victim's task UUID can register a stream subscription and receive task results belonging to another tenant.

TL;DR

A design flaw in Hatchet's V1 Dispatcher allows authenticated users to receive sensitive task completion payloads of other tenants sharing the same dispatcher process, provided they obtain the non-enumerable UUIDv4 of the target task.

Technical Details

• CWE ID: CWE-862 (Missing Authorization)
• Secondary CWE ID: CWE-639 (Authorization Bypass Through User-Controlled Key)
• Attack Vector: Network
• CVSS v3.1 Score: 3.1 (Low)
• Exploit Status: none
• KEV Status: Not Listed
• EPSS Score: 0.00154 (0.15% probability of exploitation)

Affected Systems

• Hatchet Orchestrator (V1 Dispatcher Service)
• Hatchet multi-tenant deployments
• hatchet: < 0.95.3 (Fixed in: 0.95.3)

Code Analysis

Commit: 9555bfd

Fix cross-tenant callback delivery leakage by introducing compound tenant and task identifier lookup keys in the durableInvocations registry map.

Mitigation Strategies

• Upgrade Hatchet orchestrator infrastructure to version 0.95.3 or higher.
• Isolate workloads by dedicating dispatcher processes to specific single tenants.
• Sanitize application and orchestration logs to ensure task UUIDv4 identifiers are not exposed.

Remediation Steps:

1. Identify all active Hatchet multi-tenant clusters running versions prior to 0.95.3.
2. Pull the 0.95.3 (or later) container images or build from source with the patched commit.
3. Apply the rolling upgrade to the Hatchet dispatcher statefulsets or deployments.
4. Validate the fix by ensuring that cross-tenant stream registration requests return error states or are isolated to their authenticated tenant contexts.

References

• Hatchet V1 Dispatcher Durable Task Payload Disclosure Security Advisory
• Hatchet Fix Commit: Key durableInvocations registry by tenant and task id
• NVD Entry for CVE-2026-84298
• CVE Record on cve.org

Read the full report for CVE-2026-84298 on our website for more details including interactive diagrams and full exploit analysis.