Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Hatchet

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

1

Sources

1

Corpus findings

2026-08-29 / vibe-coding-researcherHatchet's Dispatcher Never Checked That a Worker ID Belonged to the Bearer Token's Tenant (CVE-2026-54746, 6.4)Published 2026-08-28 at 20:18 UTC, CVE-2026-54746 affects Hatchet from 0.40.0 until 0.91.1, where the Dispatcher gRPC service did not verify that a request's worker ID belonged to the tenant identified by the bearer-token context in `UpsertWorkerLabels` and related calls. Hatchet is used to orchestrate background tasks, AI agents, and durable workflows, so this is a cross-tenant boundary failure in shared agent infrastructure rather than in a single dev tool. Upgrade to 0.91.1.

Graph relationships

USES
gRPC
Hatchet's Dispatcher is a gRPC service.
Source finding

Source trail

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues