CVE-2026-84298

Executive Summary

CVE-2026-84298 is an authorization bypass (CWE-639) in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, affecting versions prior to 0.95.3. The V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before verifying tenant ownership, and callback delivery subsequently resolves this map by task UUID without tenant identity checks. An authenticated tenant worker who knows another tenant's durable task UUID and maintains an open stream on the same dispatcher process can receive that task's durable callback result payload, resulting in cross-tenant information disclosure (CVSS 3.1, Low confidentiality impact).

Technical Analysis

The vulnerability resides in the V1 DurableTask stream handler. Hatchet operates a worker model in which tenant-supplied workers connect to a dispatcher and maintain streaming channels for task execution and durable callback delivery. The durableInvocations routing map is the internal structure that maps task identifiers to the delivery channel/state for durable callback results.

The core flaw is a missing or out-of-order authorization check. According to the NVD description, the handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified. This means the routing map can be populated with entries that have not been validated as belonging to the submitting worker's tenant. Later, callback delivery resolves that map by task UUID without re-checking tenant identity: the dispatcher looks up the entry solely by the durable task UUID and delivers the callback result payload to the associated stream.

The combination of (1) premature insertion of attacker-controllable routing entries and (2) UUID-only resolution during callback delivery enables cross-tenant data leakage. An attacker who is an authenticated tenant worker on the same dispatcher process, and who knows a victim tenant's durable task UUID, can cause that task's callback result payload to be routed into a stream the attacker controls.

Constraints that limit exploitability:

• UUIDv4 values are not enumerable. Knowledge of the victim's durable task UUID is a precondition; without it the attack cannot be mounted.
• The attacker must be an authenticated tenant worker (PR:L) and must keep a stream open on the same dispatcher process that handles the victim's task.
• The vulnerability affects callback result payloads — the durable callback data returned by a task — not necessarily the ability to execute tasks or modify state. The CVSS vector (C:L, I:N, A:N) is consistent with read-only cross-tenant data exposure.

This is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key): the routing key is influenced by worker-supplied input (task_external_id) and used in a lookup context that lacks tenant scoping. The description does not disclose specific function, method, or API names beyond V1 DurableTask, task_external_id, and durableInvocations; further implementation detail is insufficiently available.

Exploitation Scenarios

No public PoC or exploit code is available; the following chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker must possess: (a) a valid authenticated worker/tenant account on the target Hatchet deployment, (b) network access to the dispatcher, and (c) knowledge of a victim tenant's durable task UUID. UUIDs are not enumerable, so this knowledge is typically acquired through a separate disclosure (logs, error messages, shared output, leaked artifacts) or a secondary vector. Multi-tenant deployments sharing a dispatcher process are the relevant target class; single-tenant deployments are unaffected in practice.

2. Triggering the flaw class. The attacker's worker submits a task_external_id value that causes an entry to be written into the durableInvocations routing map before the handler verifies tenant ownership. Because the ownership check is either missing or performed after the map insertion, the attacker can influence the routing map state.

3. Payload / execution at the vulnerability-class level. The attacker keeps a stream open on the same dispatcher process. When another tenant's durable task completes and its callback is delivered, the dispatcher resolves the durableInvocations map by task UUID without tenant identity — the lookup does not scope the entry to its owning tenant. If the attacker's known UUID corresponds to the victim's task, the callback result payload is delivered to the attacker-controlled stream. There is no code injection or write primitive; the attack is a routing/authorization confusion that redirects delivery.

4. Post-exploitation impact. The attacker receives the victim task's durable callback result payload, which may contain workflow outputs, intermediate data, or agent results. Per the CVSS vector this is a confidentiality-only leak (C:L, I:N, A:N). The attacker does not gain code execution, persistent access, or data integrity control through this flaw alone. The value of the disclosure depends entirely on what the victim's durable task returns (e.g., sensitive business data or AI agent output).

Impact Assessment

• Business impact: Cross-tenant data exposure in a multi-tenant orchestration platform. Where durable workflows process sensitive data (e.g., AI agent outputs, business process results), leakage may constitute a confidentiality breach with regulatory implications depending on the data involved.
• Affected systems: Hatchet deployments prior to 0.95.3 that run multiple tenants on a shared dispatcher process.
• Blast radius: Limited. The attack is gated by high complexity and non-enumerable UUIDs (AC:H), requires authenticated worker access (PR:L), and requires knowledge of the specific victim task UUID. CVSS 3.1 with C:L/I:N/A:N rates overall severity as Low. Single-tenant deployments are unaffected in practice, per the advisory. No public exploit, no Nuclei template, no CISA KEV listing, and no active exploitation campaign is documented in the provided data.
• CVSS subscores: AV:N (remote), AC:H (requires UUID knowledge and stream co-location), PR:L (authenticated tenant worker), UI:N (no user interaction), S:U (scope unchanged), C:L (limited confidentiality), I:N, A:N.

Detection Guidance

Sigma Rule

title: Hatchet Cross-Tenant Durable Callback Access Attempt (CVE-2026-84298)
id: 3f8c2a14-9d67-4b21-a5e0-hatchet84298
status: experimental
description: Detects anomalous durable task callback delivery where a worker streams results for a durable task UUID not owned by its authenticated tenant in Hatchet versions prior to 0.95.3.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84298
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: hatchet
  service: dispatcher
detection:
  selection:
    event_type: 'durable_callback_delivery'
  suspicious:
    - tenant_id|field: 'caller_tenant_id'
    - tenant_ownership_verified: 'false'
  condition: selection and suspicious
falsepositives:
  - Legitimate callback delivery in single-tenant deployments
  - Internal dispatcher health checks
level: medium
tags:
  - attack.t1213
  - cve.2026.84298

YARA Rule

rule CVE_2026_84298_Hatchet_Tenant_Routing_Bypass
{
    meta:
        description = "Detects references to the vulnerable Hatchet V1 DurableTask durableInvocations routing pattern in logs or artifacts"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84298"
        date = "2026-01-01"
        severity = "low"
    strings:
        $a = "durableInvocations" ascii nocase
        $b = "task_external_id" ascii nocase
        $c = "DurableTask" ascii nocase
        $d = "tenant" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or true) and
        any of ($a, $b) and ($c or $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84298 Hatchet DurableTask tenant routing access attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"DurableTask"; nocase; content:"task_external_id"; nocase; sid:8429801; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-84298, confidence medium;)

Elastic Detection

event.category: "process" and event.action: "durable_callback_delivery" and
not process.tenant_ownership_verified: "true" and
process.event_type: "durable_callback_delivery"

Splunk SPL Query

index=hatchet sourcetype=hatchet:dispatcher event_type=durable_callback_delivery
| eval mismatch = if(caller_tenant_id != task_tenant_id, 1, 0)
| where mismatch = 1
| stats count min(_time) as first_seen max(_time) as last_seen by caller_tenant_id task_tenant_id task_id
| where count >= 1
| table first_seen last_seen caller_tenant_id task_tenant_id task_id count

Wazuh OSSEC Rule

<group name="hatchet,cve-2026-84298,">
  <rule id="842980" level="6">
    <decoded_as>json</decoded_as>
    <field name="event_type">durable_callback_delivery</field>
    <field name="tenant_ownership_verified">false</field>
    <description>CVE-2026-84298: Potential cross-tenant Hatchet durable callback delivery without tenant ownership verification</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_84298,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Isolate tenants onto separate dispatcher processes where operationally feasible; the vulnerability requires co-location on the same dispatcher process, so process separation removes the attack precondition.
   • Enforce strict tenant namespace isolation for durable task UUIDs and avoid exposing task UUIDs to parties outside the owning tenant (logs, error messages, shared outputs).
   • Restrict and monitor worker stream creation on dispatchers, and review which tenants are permitted to share a dispatcher.
   • Treat durable callback payloads as potentially sensitive; avoid placing high-value secrets in durable task results.

2. Patch / upgrade steps

   • The NVD description states the issue is fixed in version 0.95.3. Upgrade Hatchet to 0.95.3 or later. No vendor advisory reference or vendor-supplied workaround was provided in the tracked data; verify against the upstream project release notes before and after upgrading.

3. Long-term hardening

   • Ensure authorization checks (tenant ownership verification) occur before any routing-map insertion, and that callback delivery resolves routes with tenant identity scoping rather than UUID alone.
   • Adopt defense-in-depth for multi-tenant isolation: per-tenant channel namespacing and tenant-scoped routing tables.
   • Add regression tests for cross-tenant routing/delivery and integrate UUID/sensitive-identifier redaction into logging pipelines.

References

• NVD — CVE-2026-84298: https://nvd.nist.gov/vuln/detail/CVE-2026-84298
• Hatchet project (vendor/upstream) release notes for version 0.95.3
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document

No public PoC, exploit code, Nuclei template, CISA KEV listing, or documented threat actor campaign is associated with this CVE in the provided data.