CVE-2026-63342

MediumCVSS 6.3/10Last modified Sep 29, 2026

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Sep 21, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-633439.9Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink poinCVE-2026-633497.0AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO acceptCVE-2026-63355.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allCVE-2026-633509.6Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social enCVE-2026-633516.1Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before CVE-2026-633526.1Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace pageCVE-2026-633539.6Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This CVE-2026-633549.6Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the TCVE-2026-633556.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on theCVE-2026-633566.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messaCVE-2026-633576.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the TrCVE-2026-633587.3FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()
CVE-2026-63342: Medium severity, CVSS 6.3 | Vulnix