CyberRota Analysis
AI-GeneratedThe Dispatcher gRPC service in Hatchet versions 0.40.0 to 0.91.1 is vulnerable due to inadequate verification of worker IDs against tenant contexts, allowing authenticated users to manipulate or disconnect workers belonging to other tenants. This flaw can lead to cross-tenant integrity issues and potential denial of service in multi-tenant environments. Organizations using multi-tenant Hatchet Cloud or shared self-hosted deployments should prioritize upgrading to version 0.91.1 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher. This can cause cross-tenant integrity impact and denial of service on multi-tenant Hatchet Cloud or shared self-hosted deployments. Single-tenant deployments are not practically affected because the attacker and target tenant are the same. This issue is fixed in version 0.91.1.