https://vulnerability.circl.lu/sightings/feed 2026-09-24T22:14:53.744932+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/91c33e9a-ba17-4c6a-8a9c-2b316e477296/export 2026-09-24T22:14:53.766314+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "91c33e9a-ba17-4c6a-8a9c-2b316e477296", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84298", "type": "seen", "source": "https://gist.github.com/alon710/e9f5751d53da9a852f30f01c259b5c25", "content": "# CVE-2026-84298: CVE-2026-84298: Cross-Tenant Authorization Bypass and Information Disclosure in Hatchet V1 Dispatcher\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84298\n\n## Summary\nHatchet V1 Dispatcher before version 0.95.3 fails to enforce proper tenant boundaries when managing active stream connections for durable task completions. Because the global lookup map is keyed solely by task external identifiers, authenticated attackers who obtain a victim's task UUID can register a stream subscription and receive task results belonging to another tenant.\n\n## TL;DR\nA design flaw in Hatchet's V1 Dispatcher allows authenticated users to receive sensitive task completion payloads of other tenants sharing the same dispatcher process, provided they obtain the non-enumerable UUIDv4 of the target task.\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Secondary CWE ID**: CWE-639 (Authorization Bypass Through User-Controlled Key)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.1 (Low)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n- **EPSS Score**: 0.00154 (0.15% probability of exploitation)\n\n## Affected Systems\n\n- Hatchet Orchestrator (V1 Dispatcher Service)\n- Hatchet multi-tenant deployments\n- **hatchet**: < 0.95.3 (Fixed in: `0.95.3`)\n\n## Mitigation\n\n- Upgrade Hatchet orchestrator infrastructure to version 0.95.3 or higher.\n- Isolate workloads by dedicating dispatcher processes to specific single tenants.\n- Sanitize application and orchestration logs to ensure task UUIDv4 identifiers are not exposed.\n\n**Remediation Steps:**\n1. Identify all active Hatchet multi-tenant clusters running versions prior to 0.95.3.\n2. Pull the 0.95.3 (or later) container images or build from source with the patched commit.\n3. Apply the rolling upgrade to the Hatchet dispatcher statefulsets or deployments.\n4. Validate the fix by ensuring that cross-tenant stream registration requests return error states or are isolated to their authenticated tenant contexts.\n\n## References\n\n- [Hatchet V1 Dispatcher Durable Task Payload Disclosure Security Advisory](https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-9q4h-f4x5-ffq8)\n- [Hatchet Fix Commit: Key durableInvocations registry by tenant and task id](https://github.com/hatchet-dev/hatchet/commit/9555bfdd1e97f61d25e614ccaa107c5fb7dc4976)\n- [NVD Entry for CVE-2026-84298](https://nvd.nist.gov/vuln/detail/CVE-2026-84298)\n- [CVE Record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-84298)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84298) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T01:31:28.156699Z"} 2026-09-23T01:31:28.156699+00:00