{"id":"EUVD-2026-83980","revision":"33c12eec8a2e43b898d75cad1fbf8ec8","records":[{"revision":"33c12eec8a2e43b898d75cad1fbf8ec8","observedAt":"2026-10-28T10:35:43.991+00:00","statement":{"source":"euvd","id":"EUVD-2026-83980","aliases":["CVE-2026-88978","GHSA-992g-9cr3-vm5x"],"title":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and bra…","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":null}],"references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83980","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 21, 2026, 3:49:12 PM","dateUpdated":"Sep 24, 2026, 10:18:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83980","identifiers":["EUVD-2026-83980","CVE-2026-88978","GHSA-992g-9cr3-vm5x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}