{"action":"Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later.","affected":[{"fixed":"0.91.1","introduced":"0"}],"component":"github.com/hatchet-dev/hatchet","cve_ids":["CVE-2026-63342"],"ecosystem":"Go","epss":0.00314,"exploited":false,"fixed_versions":["0.91.1"],"ghsa_id":"GHSA-g26x-m427-f48f","id":"tcs_01M5KFA3Z2NQ7CYTGQM9CGBND3","modified_at":"2026-10-01T20:56:00.191196746Z","published_at":"2026-09-22T20:34:14Z","references":["https://osv.dev/vulnerability/GHSA-g26x-m427-f48f","https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f","https://nvd.nist.gov/vuln/detail/CVE-2026-63342","https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb","https://github.com/hatchet-dev/hatchet"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-g26x-m427-f48f","url":"https://osv.dev/vulnerability/GHSA-g26x-m427-f48f"}],"summary":"Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check"}