Hatchet Broken Object-Level Authorization on Durable Task Event Log
First seen Sep 22, 2026 · Updated Sep 22, 2026 · CVSS 6.3
Hatchet, a platform used to orchestrate AI agent workflows and durable tasks, contains a broken object-level authorization flaw in its durable-task event log endpoint. An authenticated user from one tenant who guesses or obtains another tenant's durable task UUID can read that tenant's task event log, exposing workflow logic, prompts, and timing data. This is a cross-tenant data leak rather than an agentic reasoning attack, but it can expose sensitive agent workflow internals.
Technical Analysis
The GET /api/v1/stable/durable-tasks/{durable-task} endpoint, implemented by listDurableEventLog, does not enforce that the requested durable-task UUID belongs to the tenant of the authenticated caller. Because the tenant is not validated as a parent resource in the API contract, any authenticated user who obtains a valid task UUID (e.g., via enumeration, leakage, or shared logs) can retrieve another tenant's event log. The disclosed data includes task display names, workflow identifiers, user messages, branching/wait conditions, and timing information—potentially revealing proprietary AI agent workflow logic and embedded prompts. This is a classic IDOR/BOLA vulnerability that crosses tenant isolation boundaries within a multi-tenant AI agent orchestration platform.
Affected Systems
Hatchet
Detection Signatures
- Log requests to /api/v1/stable/durable-tasks/{durable-task} where the durable-task UUID's tenant does not match the authenticated user's tenant
- Unusual sequential or bulk enumeration of durable-task UUIDs by a single authenticated account
- Access patterns where a tenant repeatedly queries task IDs never returned to it via normal listing endpoints
Remediation Steps
- 1
Upgrade Hatchet
Update to Hatchet version 0.91.1 or later, which fixes the missing tenant-scoping check on the durable-task event log endpoint.
- 2
Enforce tenant-scoped authorization
Ensure all API endpoints validate that requested resource IDs belong to the caller's tenant before returning data, treating tenant as a required parent resource in API contracts.
- 3
Audit access logs
Review historical access logs for cross-tenant durable-task UUID requests to determine if this flaw was exploited.
- 4
Rotate sensitive workflow data
If exposure is suspected, review and rotate any sensitive information (prompts, credentials, business logic) embedded in affected workflow event logs.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.