The vulnerability in Hatchet’s WorkerStatus gRPC endpoint allows an authenticated tenant worker that knows another tenant’s durable-task UUID to read durable event‑log records belonging to that other tenant. This occurs because the ListSatisfiedEntries call is called without a tenant filter. The weakness is a missing authorization check, which can lead to unauthorized disclosure of task history and potentially sensitive data. The flaw does not allow modification of data or execution of code, but it permits read access across tenant boundaries.

Hatchet, the open‑source orchestration platform, is affected in all releases prior to version 0.106.1. The fix was applied in 0.106.1, so any deployment running an older version is vulnerable.

The CVSS score is 4.3, indicating low severity. EPSS is not available and the issue is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. However, an attacker would need to be an authenticated worker belonging to a tenant that can obtain or guess another tenant’s UUID. Because the task identifiers are UUIDv4, the probability of random discovery is extremely low, but the risk remains if an attacker can acquire the UUID through other means.