Hatchet's Dispatcher Never Checked That a Worker ID Belonged to the Bearer Token's Tenant (CVE-2026-54746, 6.4)

NVD·medium signalXBlueskyLinkedInCopy link

Published 2026-08-28 at 20:18 UTC, CVE-2026-54746 affects Hatchet from 0.40.0 until 0.91.1, where the Dispatcher gRPC service did not verify that a request's worker ID belonged to the tenant identified by the bearer-token context in `UpsertWorkerLabels` and related calls. Hatchet is used to orchestrate background tasks, AI agents, and durable workflows, so this is a cross-tenant boundary failure in shared agent infrastructure rather than in a single dev tool. Upgrade to 0.91.1.