A critical authorization flaw in Hatchet versions prior to 0.91.1 permits authenticated users to perform unauthorized cross-tenant data access, leading to the exposure of sensitive workflow metadata.

The vulnerability exists in the GET /api/v1/stable/durable-tasks/{durable-task} endpoint, where the listDurableEventLog function fails to perform a tenant-level authorization check. This allows any authenticated user who discovers a valid durable task UUID to retrieve information associated with a different tenant.

Successful exploitation results in the unauthorized disclosure of sensitive business process data, including workflow identifiers, user messages, branching logic, and timing information. While the CVSS score of 6.3 reflects the requirement for authentication and specific knowledge of a task UUID, the potential for cross-tenant data leakage in a multi-tenant orchestration platform poses a significant risk to data confidentiality and compliance.

Immediate Action: Upgrade the Hatchet installation to version 0.91.1 or later to implement the necessary tenant-level authorization checks.

Proactive Monitoring: Review API access logs for anomalous patterns, specifically looking for repeated GET requests to the /api/v1/stable/durable-tasks/ endpoint that target UUIDs outside of expected tenant scopes.

Compensating Controls: Implement strict API gateway policies or WAF rules to restrict access to the durable task API if immediate patching is not possible.

Public Exploit Available: No

Given the potential for sensitive information leakage across tenant boundaries, organizations utilizing Hatchet for workflow orchestration must prioritize upgrading to version 0.91.1 immediately. Failure to address this authorization gap could allow malicious actors to gain unauthorized insight into internal business logic and workflow execution details.