CVE-2026-54746

Executive Summary

CVE-2026-54746 is an authorization bypass vulnerability in Hatchet, an open-source platform for orchestrating background tasks, AI agents, and durable workflows. The flaw affects versions 0.40.0 through 0.91.0 and resides in the Dispatcher gRPC service, where two RPC endpoints fail to verify that a request's worker ID belongs to the tenant associated with the bearer-token context. An authenticated attacker from any tenant who can guess or enumerate another tenant's worker UUID can overwrite affinity labels or forcibly disconnect worker instances, leading to cross-tenant integrity loss and denial of service. The issue is fixed in version 0.91.1 and carries a CVSS score of 6.4 under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/I:L/A:L, indicating a medium-severity flaw with significant cross-tenant scope.

Technical Analysis

The root cause of CVE-2026-54746 is a missing authorization check in the Dispatcher gRPC service of Hatchet. Specifically, the endpoints Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe fail to validate that the worker ID supplied in the request belongs to the tenant identified by the authenticated bearer-token context. This is a classic instance of CWE-639 (Authorization Bypass Through User-Controlled Key), where the application relies on user-supplied identifiers without verifying ownership.

The attack surface is the gRPC interface exposed by the Dispatcher service. In a multi-tenant deployment — such as Hatchet Cloud or shared self-hosted instances — each tenant authenticates with a bearer token, which establishes a tenant context for the request. However, the two affected RPC methods accept a worker ID as a parameter and do not cross-check that this ID is associated with the tenant context. Consequently, an authenticated user with a valid tenant token can supply a worker UUID belonging to a different tenant.

The impact manifests in two ways:

1. Integrity: By invoking UpsertWorkerLabels, an attacker can overwrite the affinity labels of a victim's worker. Affinity labels are used for task routing decisions; altering them can cause workloads to be scheduled to unintended workers, corrupting job allocation logic.
2. Availability: By invoking Unsubscribe, an attacker can disconnect a victim's worker from the dispatcher, forcing it to re-register or become unavailable for task distribution, thereby disrupting the victim's workflow execution.

The vulnerability is confined to the Dispatcher component; other gRPC services are not implicated based on the NVD description. Code-level specifics — such as the exact function signatures or the parameter validation logic — are not disclosed. However, the vulnerability class suggests that the tenant context is established via the bearer token, and the worker ID parameter is treated as a trusted input without a binding check against the tenant's worker registry.

Single-tenant deployments are not practically exploitable because the attacker and the target tenant are identical—the authorization bypass offers no additional privilege within the same tenant boundary. The flaw only becomes security-relevant in shared environments where tenant isolation is a trust boundary.

Exploitation Scenarios

The attack chain for CVE-2026-54746 follows a logical progression from authentication to cross-tenant action. Since no public PoC exists, this chain is inferred from the vulnerability class and the mechanics described in the NVD data.

Step 1 — Reconnaissance/Target Identification: The attacker must be an authenticated user of any tenant on the target Hatchet deployment. They first enumerate or guess worker UUIDs belonging to other tenants. Worker UUIDs may be leaked through logs, monitoring dashboards, or predictable ID generation patterns (if UUIDs are sequential, which is atypical for v4 UUIDs, this becomes trivial). In gRPC-based systems, the service may expose reflection or health-check endpoints that reveal valid identifiers. Absent such information, brute-forcing worker UUIDs is technically feasible but resource-intensive due to the 128-bit UUID space.

Step 2 — Triggering the Flaw: The attacker crafts a gRPC request to either Dispatcher/UpsertWorkerLabels or Dispatcher/Unsubscribe, supplying the victim's worker UUID as a parameter while authenticating with their own tenant's bearer token. The service processes the request without verifying that the worker UUID belongs to the authenticated tenant.

Step 3 — Payload/Execution: At the vulnerability-class level, this is a parameter-injection escalation: the request contains attacker-controlled data (the worker ID) that is trusted by the server-side authorization logic. For UpsertWorkerLabels, the payload includes a map of key-value labels to be applied to the target worker. For Unsubscribe, the payload is simply the victim worker's ID, which triggers a disconnect event.

Step 4 — Post-Exploitation Impact: After successful exploitation, the attacker has achieved one of two outcomes:

• Affinity label corruption, which can cause the victim's tasks to be routed to unintended workers, degrading task execution integrity and potentially revealing task data to unauthorized workers (a secondary confidentiality impact not directly scored in this CVE).
• Worker disconnection, which interrupts the victim's workflow processing until the worker re-registers, creating a denial-of-service condition.

In a multi-tenant Hatchet Cloud environment, a single attacker can target multiple victims sequentially, amplifying the cross-tenant impact. The CVSS scope score of "Changed" explicitly acknowledges that the compromise extends beyond the attacker's tenant boundaries.

Proof of Concept Intelligence

No public proof-of-concept (PoC) is currently available for CVE-2026-54746. There are no Nuclei templates, exploit code repositories, or published write-ups referencing this vulnerability at the time of analysis.

Why exploitation may still be possible: The absence of a public PoC does not preclude real-world exploitation. First, the vulnerability class (CWE-639) is well understood and has a substantial body of prior research; an attacker familiar with gRPC authorization pitfalls can likely craft a working exploit from the description alone. Second, the affected endpoints (UpsertWorkerLabels, Unsubscribe) are documented gRPC methods in Hatchet's API surface, so the request structures are inferable from the project's public documentation. Third, the fix in version 0.91.1 implies that the flaw was confirmed and remedied, which means the pre-fix code was exploitable in practice.

Resources to monitor for future PoC disclosure:

• Hatchet's GitHub repository (github.com/hatchet-dev/hatchet) — issues, pull requests, and security advisories.
• Public exploit databases: Exploit-DB, Packet Storm Security, and GitHub's security advisories feed.
• gRPC-specific security research forums and CVE aggregator comment sections.
• Social media / security researcher accounts that frequently publish CVE PoCs shortly after patch releases (e.g., @PwnFunction, ProjectDiscovery Discord channels).
• NVD's CVE page — the "references" section may update if a proof-of-concept is linked.

Impact Assessment

Business Impact: For organizations operating multi-tenant Hatchet deployments (Hatchet Cloud customers or shared self-hosted instances), this vulnerability enables cross-tenant interference and disruption. The integrity impact (affinity label overwrite) can compromise workload routing decisions, potentially misdirecting sensitive background tasks to untrusted workers. The availability impact (worker disconnection) can cause workflows to stall, affecting dependent business processes.

Affected Systems: Any Hatchet deployment running version 0.40.0 through 0.91.0 that exposes the Dispatcher gRPC service to authenticated tenants. Single-tenant deployments are technically affected but practically immune due to the absence of a cross-tenant trust boundary.

Blast Radius: According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/I:L/A:L), the attack is network-based, requires low attack complexity, and requires a low-privilege authenticated account. No user interaction is needed. The scope is "Changed," meaning the compromised component (Dispatcher service) impacts resources beyond the attacker's authorized tenant. The confidentiality impact is NONE (per the vector), but the integrity and availability impacts are LOW each. EPSS is not yet scored, so the probability of exploitation in the wild is unknown.

Asset Value: Hatchet is commonly used for orchestrating AI agents and durable workflows; these workloads often handle sensitive data and are mission-critical. A cross-tenant DoS or integrity compromise could disrupt production pipelines and erode customer trust in the hosting provider.

Detection Guidance

The following detection playbooks assume network visibility into gRPC traffic and access to logs generated by the Hatchet Dispatcher service.

Sigma Rule

title: Hatchet Dispatcher Cross-Tenant Worker ID Abuse
id: 3f8a2c11-9b4d-4e7a-8c5f-6d1e2a3b4c5d
status: experimental
description: Detects requests to Hatchet Dispatcher gRPC endpoints where worker ID does not match the tenant context, indicating potential CVE-2026-54746 exploitation.
logsource:
  product: hatchet
  service: dispatcher
detection:
  selection_rpc:
    grpc.method:
      - Dispatcher/UpsertWorkerLabels
      - Dispatcher/Unsubscribe
  selection_mismatch:
    tenant_id|not_eq: worker_tenant_id  # assumes logs contain both fields
  condition: selection_rpc and selection_mismatch
falsepositives:
  - Legitimate cross-tenant operations in misconfigured deployments
level: high

YARA Rule

rule Hatchet_Dispatcher_Tenant_Bypass_CVE_2026_54746
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects log patterns indicative of cross-tenant worker ID abuse in Hatchet Dispatcher"
        reference = "CVE-2026-54746"
    strings:
        $method1 = "Dispatcher/UpsertWorkerLabels"
        $method2 = "Dispatcher/Unsubscribe"
        $err_auth = "worker not found for tenant"
        $err_scope = "permission denied"
    condition:
        any of ($method*) and ($err_auth or $err_scope)
}

Note: This YARA rule is most effective when scanned against dispatcher logs; network-level YARA scanning of gRPC payloads may require decompression and protobuf parsing.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54746 Hatchet Dispatcher Cross-Tenant Access Attempt"; content:"UpsertWorkerLabels"; depth:100; content:"Unsubscribe"; distance:50; classtype:attempted-admin; sid:2026547461; rev:1;)

Note: Suricata does not natively parse gRPC (HTTP/2) content. This rule is a placeholder for HTTP/2-based detection and should be adapted for HTTP/2 support (e.g., using the http2 keyword) or used with a gRPC-aware proxy that logs method names.

Elastic Detection

sequence by host.name with maxspan=5m
  [network where protocol == "grpc" and event.action == "rpc_call" and
   process.name == "hatchet-dispatcher" and
   container.id == "<target-container>"]
  [file where event.action == "log-write" and process.name == "hatchet-dispatcher" and
   message like "*worker not found for tenant*"]

Note: This EQL rule assumes gRPC events are captured by Elastic's network integrations and that dispatcher logs contain the "worker not found for tenant" error string.

Splunk SPL Query

index=hatchet "*UpsertWorkerLabels*" OR "*Unsubscribe*"
| rex field=_raw "worker_id=(?<worker_id>[^\s]+)"
| rex field=_raw "tenant_id=(?<tenant_id>[^\s]+)"
| lookup hatchet_worker_registry.csv worker_id as worker_id OUTPUT tenant_id as worker_tenant
| where tenant_id != worker_tenant
| stats count by src_ip, worker_id, tenant_id
| where count > 3

Wazuh OSSEC Rule

<group name="hatchet,">
  <rule id="755107" level="12">
    <if_sid>100016</if_sid>
    <match>Dispatcher/UpsertWorkerLabels|Dispatcher/Unsubscribe</match>
    <regex>worker not found for tenant|permission denied</regex>
    <description>CVE-2026-54746: Cross-tenant worker ID access attempt in Hatchet Dispatcher</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from tracked sources, despite the NVD description noting a fix in version 0.91.1. This discrepancy suggests that the vendor has released a fix, but it has not been verified by the tracking sources used for this report. Organizations should independently verify the availability of version 0.91.1.

Immediate Mitigations:

1. Upgrade immediately to Hatchet version 0.91.1 or later, if available. Verify the integrity of the release via the official repository and checksums.
2. Restrict network access to the Dispatcher gRPC service to trusted tenant networks only. Implement network segmentation to reduce the attack surface.
3. Enable and review audit logs for the Dispatcher service, focusing on UpsertWorkerLabels and Unsubscribe calls. Correlate these with tenant ID and worker ID mappings.
4. If upgrade is not immediately possible, consider as a stopgap measure: disable the Dispatcher endpoints in a reverse proxy or API gateway (if architecturally feasible) and require all label updates and unsubscribes to go through an admin-only control plane.

Patch/Upgrade Steps:

1. Identify the current Hatchet version via the release manifest or Git tags.
2. Download version 0.91.1 from the official release channel (GitHub releases or package registry).
3. Perform a rolling upgrade to minimize downtime, starting with non-production environments.
4. Re-run the integration test suite to confirm no regression in dispatcher behavior.

Long-Term Hardening:

1. Adopt principle of least privilege — minimize the number of accounts with authenticated gRPC access to the Dispatcher.
2. Enforce tenant isolation testing in CI/CD — add automated tests that verify cross-tenant requests are rejected.
3. Monitor CVE feeds (NVD, vendor security advisories) for CVE-2026-54746 updates, particularly for any disclosed PoCs or in-the-wild exploitation evidence.
4. Consider using UUID v4 with cryptographically secure generation for worker IDs and review any endpoint that accepts user-supplied IDs for similar authorization bypass patterns.

References

1. NVD Entry for CVE-2026-54746: https://nvd.nist.gov/vuln/detail/CVE-2026-54746
2. Hatchet GitHub Repository (source for version history and fix verification): https://github.com/hatchet-dev/hatchet
3. CWE-639 (Authorization Bypass Through User-Controlled Key): https://cwe.mitre.org/data/definitions/639.html
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Exploitation Evidence: No known threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-54746 at this time.