{"items":[{"id":"NVI-00013965","kind":"vulnerability","title":"Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-8x7x-83cf-c3pg","CVE-2026-54746"],"plain_summary":"GitHub lists this reviewed advisory for github.com/hatchet-dev/hatchet. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-29b40b9c1630b418c8c4993ba9f743d0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-28T16:09:01.000Z","value":"6.4 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-29b40b9c1630b418c8c4993ba9f743d0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-29b40b9c1630b418c8c4993ba9f743d0","url":"https://github.com/advisories/GHSA-8x7x-83cf-c3pg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-8x7x-83cf-c3pg","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:23.004Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-29b40b9c1630b418c8c4993ba9f743d0"],"technology":"github.com/hatchet-dev/hatchet","known_exclusions":[],"conditions_summary":"### Summary\n\nA **cross-tenant write / DoS** vulnerability in the Hatchet `Dispatcher` gRPC service allows any holder of a normal tenant-scoped API token (the lowest credential Hatchet issues — an `OWNER` of a brand-new tenant) to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UUID belonging to any other tenant on the same Hatchet instance. The two affected RPCs — `Dispatcher/UpsertWorkerLabels` and `Dispatcher/Unsubscribe` — read the caller's tenant from the bearer-token context only for analytics and response shaping, and never use it to authorise the `worker_id` from the request body.\n\n\n### Impact\nThis CVE requires the attacker to successfully guess the target UUID. \n**Who is impacted.** Any Hatchet deployment that hosts more than one tenant on the same instance:\n- **Hatchet Cloud (multi-tenant SaaS)** — every tenant is exposed to every other tenant.\n- **Self-hosted Hatchet with multiple internal teams / business units sharing one instance** — each team is exposed to every other team on the box.\n- **Any deployment where a single tenant's API token can be obtained by an attacker** (e.g. a leaked low-privilege CI token from a single tenant). One tok","public_affected_ranges":[">= 0.40.0, < 0.91.2"]}],"null_published_at":"2026-11-02T10:00:37.192Z","source_updated_at":"2026-08-28T16:09:01.000Z","source_disclosed_at":"2026-08-28T16:08:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:23.004Z"}],"next_cursor":null,"snapshot_revision":"42594"}