Medium severity5.3GHSA Advisory· Published May 14, 2026· Updated May 27, 2026
CVE-2026-42572
CVE-2026-42572
Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hatchet-dev/hatchetGo | < 0.83.39 | 0.83.39 |
Affected products
3Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-55gc-6fmc-fpx9ghsaADVISORY
- github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9nvdVendor AdvisoryMitigationWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42572ghsaADVISORY
News mentions
0No linked articles in our index yet.