hatchet-dev hatchet

• CVE-2026-108755 Medium 5.3 Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint 0.3%
• CVE-2026-88978 Medium 4.3 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter 0.3%
• CVE-2026-84298 Low 3.1 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher 0.2%
• CVE-2026-61687 High 7.1 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState 0.2%
• CVE-2026-63342 Medium 6.3 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check 0.3%
• CVE-2026-61681 Medium 4.1 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler 0.3%
• CVE-2026-54746 Medium 6.4 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe 0.4%
• CVE-2026-42572 Medium 5.3 Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` 0.2%