Hatchet Dispatcher Cross-Tenant Worker Authorization Bypass

Technical Analysis

The Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe gRPC methods authenticate the caller via a bearer token scoped to a tenant, but fail to verify that the target worker ID actually belongs to that tenant (a broken object-level authorization / IDOR pattern). Any authenticated tenant owner can therefore supply a foreign worker's UUID to overwrite its affinity labels (integrity impact, potentially disrupting agent task-scheduling decisions) or unsubscribe it from the dispatcher, forcibly disconnecting an AI agent worker belonging to a different tenant (availability impact). The entry point is the gRPC API surface used for worker registration/management in orchestrated agent fleets; the boundary crossed is the tenant isolation boundary in a shared control plane, not a sandbox or process boundary. Exploitation requires only valid credentials for any tenant plus knowledge or guessing of another tenant's worker UUID, with no additional privilege escalation needed within the platform.

Affected Systems

Hatchet; protocols: gRPC

Detection Signatures

• Dispatcher gRPC calls (UpsertWorkerLabels, Unsubscribe) where the worker_id in the request does not belong to the tenant_id derived from the bearer token
• Unexpected worker disconnect/reconnect churn for workers not owned by the calling tenant
• Repeated UpsertWorkerLabels calls targeting worker IDs outside the caller's known worker pool
• Audit logs showing tenant A's API token referencing tenant B's worker UUIDs

Remediation Steps

1. 1

   Upgrade Hatchet

   Update to Hatchet version 0.91.1 or later, which enforces tenant-ownership validation on Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe.

2. 2

   Add server-side tenant ownership checks

   Ensure every gRPC handler that accepts a worker_id validates that the worker's tenant matches the tenant derived from the bearer token before performing any mutation or disconnect.

3. 3

   Use non-guessable worker identifiers

   Adopt cryptographically random, sufficiently long UUIDs for workers and avoid exposing worker IDs in logs or client-visible contexts shared across tenants.

4. 4

   Monitor cross-tenant access attempts

   Add alerting for dispatcher requests where the resolved worker tenant does not match the authenticated caller's tenant.

5. 5

   Restrict multi-tenant deployment exposure

   For shared/self-hosted multi-tenant deployments, apply network or application-layer segmentation until patched, and audit worker label/disconnect events retroactively.