CVE-2026-42572CWE-639CWE-863

Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`

Medium · published May 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-05-14T16:58Z
EPSS history
Timeline
  • 14 MAY 16:58Z
    Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds`
    cvelistv5