CVE-2026-88978

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.106.1

Description The WorkerStatus gRPC polling path in pkg/repository/durable events.go passes caller-supplied durable task, node, and branch identifiers to the ListSatisfiedEntries() function without applying a tenant filter. This allows an authenticated tenant worker to retrieve durable event-log records belonging to another tenant if the worker knows the target tenant's durable-task UUID. Because the system uses UUIDv4, the likelihood of exploitation is low, and single-tenant deployments are not affected.

Recommendations Update to version 0.106.1.