CVE-2026-63342

Executive Summary

CVE-2026-63342 is an improper authorization vulnerability in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to version 0.91.1, the GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not enforce the target tenant as a parent resource in its authorization checks. This allows any authenticated user who obtains another tenant's durable task UUID to read that task's event log, exposing sensitive workflow metadata, user messages, branching logic, and timing information across tenant boundaries. The issue is fixed in version 0.91.1.

Technical Analysis

The vulnerability is classified as CWE-863: Incorrect Authorization. The root cause lies in the design of the GET /api/v1/stable/durable-tasks/{durable-task} endpoint defined in api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml. This endpoint is implemented by the listDurableEventLog function. The authorization model for this endpoint fails to require the target tenant as a parent resource. In a multi-tenant orchestration platform, resources such as durable tasks are expected to be scoped to a tenant. Proper authorization would verify that the authenticated user belongs to the tenant that owns the requested durable task UUID before returning any data.

Because this parent-resource check is absent, the endpoint effectively operates on a flat namespace governed only by knowledge of the durable task's UUID. Any authenticated user who can guess, obtain, or otherwise learn another tenant's durable task UUID can invoke the endpoint and retrieve that task's event log. The CVSS vector reflects this: the attack is network-accessible (AV:N), requires low privileges (PR:L) as the attacker must be authenticated, and requires high attack complexity (AC:H) because successful exploitation depends on acquiring a valid UUID from another tenant. The scope is changed (S:C), indicating the vulnerable component impacts resources beyond its own security scope—specifically, data belonging to other tenants. Confidentiality is high (C:H), while integrity and availability impacts are none (I:N/A:N).

The disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This information is typically not considered highly sensitive in isolation, but in aggregate it reveals operational details about other tenants' workflows, including the structure of their automation logic, the content of user-provided messages, and the timing of task execution. Such data could facilitate further attacks, competitive intelligence gathering, or privacy breaches.

No public proof-of-concept, exploit code, or Nuclei template is available for this vulnerability. The attack chain is inferred from the vulnerability class (broken access control / missing tenant scoping) and the specific endpoint details provided in the NVD description.

Exploitation Scenarios

1. Reconnaissance/target identification: The attacker must first gain authenticated access to the Hatchet platform, either as a legitimate user of one tenant or through compromised credentials. They then need to identify or obtain a durable task UUID belonging to a different tenant. UUIDs are typically not guessable, but they may leak through logs, error messages, shared links, API responses from other endpoints, or insider knowledge. The attacker may also probe the API for endpoints that list or expose task identifiers without proper scoping.

2. Triggering the flaw: With a valid durable task UUID from another tenant, the attacker sends a GET request to /api/v1/stable/durable-tasks/{durable-task}, substituting the target UUID. Because the endpoint does not verify that the authenticated user's tenant matches the tenant that owns the task, the request is processed and the event log is returned.

3. Payload/execution method: This is a direct API request. No special payload or injection is required—the flaw is purely an authorization bypass. The attacker simply supplies the target UUID in the URL path. The request can be made using standard HTTP clients, curl, or a browser.

4. Post-exploitation impact: The attacker receives the event log for the targeted durable task, which may contain task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This data can be used to map another tenant's workflows, extract sensitive business logic, identify additional tasks or users, and potentially pivot to further attacks. The confidentiality breach is cross-tenant, meaning the attacker's own tenant is not affected, but the victim tenant's data is exposed.

No public PoC is available; the attack chain is inferred from the vulnerability class and the endpoint behavior described.

Impact Assessment

The business impact of CVE-2026-63342 is primarily a confidentiality breach across tenant boundaries. Organizations using Hatchet for orchestrating background tasks, AI agents, and durable workflows may have sensitive operational data exposed to unauthorized parties. This includes the structure of automated workflows, user-generated messages, and timing information that could reveal business processes, schedules, or dependencies. The blast radius is limited to the data accessible via the vulnerable endpoint—specifically, event logs of durable tasks—but because the flaw bypasses tenant isolation, any tenant's data could be at risk if its task UUIDs are known.

The CVSS score is 6.3 (Medium), with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N. The high attack complexity (AC:H) reflects the need to obtain a valid UUID from another tenant, which is not trivial. The low privileges required (PR:L) mean any authenticated user can exploit it. The changed scope (S:C) indicates the vulnerability impacts resources beyond the vulnerable component's security authority—other tenants' data. The high confidentiality impact (C:H) underscores the potential for significant data exposure. Integrity and availability impacts are none. No public exploit or PoC is available, and the issue is not listed in CISA KEV, suggesting no known active exploitation in the wild at this time. However, the lack of a patch in tracked sources (patch confidence 0/4) means organizations relying on those sources may remain exposed.

Detection Guidance

Sigma Rule

title: Hatchet Durable Task Event Log Cross-Tenant Access Attempt
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects attempts to access the durable task event log endpoint with a task UUID that does not belong to the authenticated user's tenant.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63342
author: Valters IT
date: 2026-01-01
tags:
  - attack.t1213
  - cve.2026.63342
logsource:
  category: webserver
  product: hatchet
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem|startswith: '/api/v1/stable/durable-tasks/'
  condition: selection
falsepositives:
  - Legitimate access by the owning tenant
level: medium

YARA Rule

rule CVE_2026_63342_Hatchet_CrossTenant_Access
{
    meta:
        description = "Detects HTTP requests targeting the Hatchet durable task event log endpoint with a UUID path parameter, indicative of cross-tenant access attempts."
        author = "Valters IT"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63342"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $endpoint = "/api/v1/stable/durable-tasks/"
        $uuid = /[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/
    condition:
        $endpoint and $uuid
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-63342 Hatchet Durable Task Event Log Cross-Tenant Access Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/api/v1/stable/durable-tasks/"; http.uri; pcre:"/\/api\/v1\/stable\/durable-tasks\/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/"; classtype:attempted-recon; sid:1000001; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_63342;)

Elastic Detection

sequence by user.id with maxspan=5m
  [http where http.request.method == "GET" and
   http.request.path : "/api/v1/stable/durable-tasks/*" and
   /* UUID pattern in path */
   wildcard(http.request.path, "*/api/v1/stable/durable-tasks/*-*-*-*-*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=GET uri_path="/api/v1/stable/durable-tasks/*"
| rex field=uri_path "/api/v1/stable/durable-tasks/(?<durable_task_uuid>[0-9a-fA-F-]{36})"
| where isnotnull(durable_task_uuid)
| stats count min(_time) as first_seen max(_time) as last_seen values(durable_task_uuid) as task_uuids by src_ip, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="hatchet,cve-2026-63342,">
  <rule id="100200" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v1/stable/durable-tasks/</url>
    <method>GET</method>
    <description>CVE-2026-63342: Hatchet durable task event log access attempt - possible cross-tenant data exposure</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Hatchet API to trusted networks or VPNs.
   • Implement additional authorization checks at the API gateway or reverse proxy layer to validate tenant scoping for the /api/v1/stable/durable-tasks/{durable-task} endpoint.
   • Monitor logs for suspicious access patterns to the durable task endpoint, especially from users or IPs that do not normally access such resources.
   • Rotate or invalidate any exposed durable task UUIDs if a breach is suspected.

2. Patch/upgrade steps:

   • Upgrade Hatchet to version 0.91.1 or later as soon as possible. The fix for this issue is included in that release.
   • Verify the upgrade by checking the version and testing the endpoint with cross-tenant UUIDs to ensure proper authorization errors are returned.
   • If immediate upgrade is not possible, consider disabling the affected endpoint or applying a custom authorization filter via a proxy until the upgrade can be performed.

3. Long-term hardening:

   • Adopt a tenant-aware authorization model for all API endpoints, ensuring that parent-resource checks are consistently enforced.
   • Implement automated security testing for broken access control, including cross-tenant access tests, in CI/CD pipelines.
   • Use opaque, non-guessable identifiers and avoid exposing them in logs or responses where possible.
   • Conduct regular access control reviews and penetration tests focusing on multi-tenant isolation.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63342
• Hatchet Release: Version 0.91.1 (fix version)
• CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1213: Data from Information Repositories — https://attack.mitre.org/techniques/T1213/
• No known threat actor campaigns or exploit-in-the-wild evidence available at this time.