Hatchet V1 DurableTask Cross-Tenant Callback Leak via Task UUID

Technical Analysis

The V1 DurableTask stream handler registers worker-supplied task_external_id values into a shared durableInvocations routing map before verifying tenant ownership of the task. Callback delivery subsequently resolves recipients from this map using only the task UUID, with no tenant identity check at delivery time. An authenticated worker belonging to Tenant A that learns or guesses Tenant B's durable task UUID, and maintains an open stream on the same dispatcher process, can receive Tenant B's callback result payload, crossing tenant isolation boundaries in a shared agent orchestration backend. Because UUIDv4 values are cryptographically non-enumerable, practical exploitation is limited to insider threats or leaked UUIDs rather than brute-force discovery.

Affected Systems

Hatchet

Detection Signatures

• Monitor Hatchet dispatcher logs for durable task stream subscriptions referencing task_external_id values not owned by the requesting tenant
• Alert on callback delivery events where resolved tenant context differs from the subscribing worker's tenant
• Audit multi-tenant Hatchet deployments below version 0.95.3

Remediation Steps

1. 1

   Upgrade Hatchet

   Update to Hatchet 0.95.3 or later, which enforces tenant ownership verification before registering durableInvocations routing entries and at callback delivery time.

2. 2

   Audit multi-tenant deployments

   Review logs for any cross-tenant durable task stream access prior to patching, especially in shared dispatcher environments.

3. 3

   Restrict UUID exposure

   Avoid leaking task_external_id/UUID values across tenant boundaries in logs, APIs, or shared UI components to reduce the attack surface even after patching.

4. 4

   Enforce tenant isolation checks

   Where feasible, deploy separate dispatcher processes per tenant for high-sensitivity workloads instead of relying solely on application-layer tenant checks.