CVE-2026-54746

Name of the Vulnerable Software and Affected Versions Hatchet versions 0.40.0 through 0.91.0

Description The Dispatcher gRPC service fails to verify if a request's worker ID belongs to the tenant identified by the bearer-token context. This occurs within the Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe endpoints. An authenticated owner of any tenant who can guess another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher. This leads to cross-tenant integrity impact and denial of service in multi-tenant Hatchet Cloud or shared self-hosted deployments. Single-tenant deployments are not practically affected.

Recommendations Update to version 0.91.1.