{"id":"GO-2026-6560","revision":"9f2398d2e6ab472fb189f709e4fdfda8","records":[{"revision":"9f2398d2e6ab472fb189f709e4fdfda8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6560","aliases":["CVE-2026-88978","GHSA-992g-9cr3-vm5x"],"title":"Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet","description":"Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:14.1847116+00:00","affected":[{"ecosystem":"Go","name":"github.com/hatchet-dev/hatchet","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.106.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","https://nvd.nist.gov/vuln/detail/CVE-2026-88978","https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6560","license":"OSV · upstream source license applies","key":"osv:GO-2026-6560","identifiers":["GO-2026-6560","CVE-2026-88978","GHSA-992g-9cr3-vm5x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}