CVE-2026-63342: Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

September 22, 2026

The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (listDurableEventLog) is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant.

References

github.com/advisories/GHSA-g26x-m427-f48f
github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb
github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f
nvd.nist.gov/vuln/detail/CVE-2026-63342

Code Behaviors & Features

Detect and mitigate CVE-2026-63342 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →