CVE-2026-42572

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.83.39

Description A missing authorization directive on the 'GET /api/v1/stable/dags/tasks' endpoint caused the tenant-membership check to be skipped. An authenticated user on a multi-tenant instance could query this endpoint using another tenant's UUID and a DAG UUID belonging to that tenant to retrieve task metadata. The exposed data includes display name, action id, step id, workflow id, workflow version id, workflow run id, task external id, tenant id, retry count, status, timestamps, and additional metadata. The additional metadata field may contain sensitive domain context such as user identifiers, customer IDs, feature flags, or correlation tokens.

Recommendations Upgrade to version 0.83.39 or later. Restrict account creation by setting SERVER AUTH RESTRICTED EMAIL DOMAINS to an allowlist of controlled domains. Ensure the API is not exposed to untrusted networks, such as by running the software inside a VPC with authenticated network controls.