Listen to this Post
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From version 0.40.0 through 0.91.1, the Dispatcher gRPC service fails to verify that a request’s worker ID belongs to the tenant identified by the bearer-token context in two specific RPCs: `Dispatcher/UpsertWorkerLabels` and Dispatcher/Unsubscribe.
The vulnerability stems from an architectural oversight in the authorization logic. When a client invokes either of these endpoints, the service reads the caller’s tenant from the bearer token present in the request context — but only for analytics and response shaping purposes. Critically, it never uses that tenant information to authorize the `worker_id` provided in the request body. This means any authenticated user who possesses valid credentials for one tenant can manipulate workers belonging to any other tenant on the same Hatchet instance, provided they can guess or otherwise obtain the correct UUID of the target worker.
An attacker exploiting this flaw can overwrite the affinity labels of another tenant’s workers, potentially disrupting task routing logic and causing workloads to be assigned incorrectly or lost entirely. Furthermore, by invoking the unsubscribe function with a guessed worker UUID from an external tenant, an adversary can forcibly disconnect those workers from the dispatcher service — effectively halting the execution of background tasks and workflows belonging to the victim tenant. This results in a denial of service that disrupts business operations dependent on these asynchronous processes. The severity is amplified by the fact that many distributed systems rely on predictable or sequential UUID generation patterns, making it feasible for attackers to enumerate valid worker identifiers through brute-force techniques.
Single-tenant deployments are not practically affected because the attacker and target tenant are the same. However, any multi-tenant Hatchet deployment — including Hatchet Cloud (multi-tenant SaaS) and self-hosted instances with multiple internal teams sharing one box — is exposed.
This issue aligns with CWE-284 (Improper Access Control) and relates closely to CWE-639 (Authorization Bypass Through User-Controlled Key).
DailyCVE Form:
Platform: Hatchet
Version: 0.40.0–0.91.0
Vulnerability: Cross-tenant write/DoS
Severity: Critical
Date: 2026-08-28
Prediction: Patch expected 2026-08-28 (fixed in 0.91.1)
What Undercode Say:
Analytics:
The vulnerability exists in the Dispatcher gRPC service’s handling of `UpsertWorkerLabels` and `Unsubscribe` RPCs. The service extracts tenant from bearer token context but fails to validate that the target `worker_id` belongs to that tenant.
Bash commands and codes related to the blog
Check Hatchet version
hatchet version
Identify vulnerable endpoints
grpcurl -plaintext localhost:8080 list | grep -E "UpsertWorkerLabels|Unsubscribe"
Example gRPC call structure (educational)
grpcurl -plaintext -H "Authorization: Bearer <tenant_token>" \
-d '{"worker_id": "<target_worker_uuid>", "labels": {"key": "value"}}' \
localhost:8080 Dispatcher/UpsertWorkerLabels
Exploit: (Educational Purposes!)
- Obtain a valid tenant-scoped API token (the lowest credential Hatchet issues — an OWNER of any tenant)
- Enumerate or guess a target worker UUID belonging to another tenant on the same instance
- Send a crafted gRPC request to `Dispatcher/UpsertWorkerLabels` with the target worker ID to overwrite affinity labels
- Alternatively, send a request to `Dispatcher/Unsubscribe` with the target worker ID to disconnect the worker
Protection:
- Upgrade Hatchet to version 0.91.1 or later, where this issue is fixed
- For multi-tenant deployments, ensure strict tenant isolation and audit all gRPC endpoints for proper authorization checks
- Implement additional monitoring for unauthorized `UpsertWorkerLabels` and `Unsubscribe` calls
- Use cryptographically random UUID generation to make brute-force enumeration infeasible
Impact:
- Integrity: Attacker can overwrite affinity labels of another tenant’s workers, disrupting task routing
- Availability: Attacker can forcibly disconnect workers, causing denial of service
- Scope: Affects Hatchet Cloud (multi-tenant SaaS) and any shared self-hosted deployment
- Privilege: Exploitable with the lowest-tier tenant API token
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
