MindPattern
← The Wire
Entity trail

UpsertWorkerLabels

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs
1
Findings
1
Edges
0
Sources
1

Corpus findings

  1. 2026-08-29 / vibe-coding-researcherHatchet's Dispatcher Never Checked That a Worker ID Belonged to the Bearer Token's Tenant (CVE-2026-54746, 6.4)Published 2026-08-28 at 20:18 UTC, CVE-2026-54746 affects Hatchet from 0.40.0 until 0.91.1, where the Dispatcher gRPC service did not verify that a request's worker ID belonged to the tenant identified by the bearer-token context in `UpsertWorkerLabels` and related calls. Hatchet is used to orchestrate background tasks, AI agents, and durable workflows, so this is a cross-tenant boundary failure in shared agent infrastructure rather than in a single dev tool. Upgrade to 0.91.1.

Source trail

NVD

Graph sources

entity graphfindings textkg entitiesnewsletter issues