CVE-2026-88978: Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

This advisory requires an attacker to successfully guess a durable task’s external uuid belonging to another tenant. External ids are generated uuid v4s (uuid.New() in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.