The flaw is a missing verification that a dispatcher request’s worker ID belongs to the tenant identified by the bearer token. An authenticated owner of any tenant can provide a worker UUID that belongs to another tenant, allowing the attacker to overwrite that worker’s affinity labels or force the worker to disconnect from the dispatcher. The result is integrity damage for the victim tenant’s workers and a potential denial of service by disconnecting workers, as the attacker can reallocate work or disrupt processing. This represents a partial authorization error (CWE‑639) and a lack of proper access control (CWE‑862).

Hatchet, produced by hatchet‑dev, is affected. Versions from 0.40.0 through 0.91.1 lack tenant verification on the Dispatcher gRPC UpsertWorkerLabels and Unsubscribe endpoints. The fix is included in release 0.91.1 and later.

The CVSS score of 6.4 indicates moderate severity. Exploitation requires the attacker to be authenticated to a tenant and to guess or discover another tenant’s worker UUID, which is realistic in shared, multi‑tenant deployments. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can thus cause cross‑tenant data integrity loss and service disruption, turning an intra‑tenant flaw into a real inter‑tenant attack when tenants share the same deployment.