| id: GO-2026-6561 |
| modules: |
| - module: github.com/hatchet-dev/hatchet |
| versions: |
| - fixed: 0.95.3 |
| vulnerable_at: 0.95.2 |
| summary: |- |
| Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 |
| Dispatcher in github.com/hatchet-dev/hatchet |
| cves: |
| - CVE-2026-84298 |
| ghsas: |
| - GHSA-9q4h-f4x5-ffq8 |
| references: |
| - advisory: https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-9q4h-f4x5-ffq8 |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-84298 |
| - fix: https://github.com/hatchet-dev/hatchet/commit/9555bfdd1e97f61d25e614ccaa107c5fb7dc4976 |
| source: |
| id: GHSA-9q4h-f4x5-ffq8 |
| created: 2026-09-28T14:09:48.921572-04:00 |
| review_status: UNREVIEWED |
