CVE-2026-54746: CWE-639: Authorization Bypass Through User-Controlled Key in hatchet-dev hatchet

Hatchet's Dispatcher gRPC service does not verify that a worker ID in requests to UpsertWorkerLabels and Unsubscribe belongs to the tenant identified by the bearer-token context. This allows an authenticated tenant owner to manipulate or disconnect workers belonging to other tenants by guessing their worker UUIDs. This leads to authorization bypass, impacting integrity and availability in multi-tenant Hatchet Cloud or shared self-hosted environments. The vulnerability affects versions from 0.40.0 through 0.91.0 and is resolved in 0.91.1.

An attacker with authenticated access to any tenant can perform unauthorized actions on workers of other tenants by guessing their worker UUIDs. This can result in cross-tenant integrity violations by overwriting affinity labels and denial of service by disconnecting workers. Single-tenant deployments are not meaningfully impacted since the attacker and target tenant are the same. The CVSS score is 6.4 (medium severity) reflecting low complexity attack with partial impact on integrity and availability.

A fix is available in Hatchet version 0.91.1. Users should upgrade to 0.91.1 or later to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version fix statement in the description.