{"action":"Upgrade github.com/hatchet-dev/hatchet to 0.91.1 or later.","affected":[{"fixed":"0.91.1","introduced":"0"}],"component":"github.com/hatchet-dev/hatchet","cve_ids":["CVE-2026-63342"],"ecosystem":"Go","epss":0.00314,"exploited":false,"fixed_versions":["0.91.1"],"ghsa_id":"GHSA-g26x-m427-f48f","id":"tcs_01M5KGVEFF38R0RX20PDBX3V27","modified_at":"2026-10-01T20:45:13.171855021Z","published_at":"2026-10-01T20:23:38Z","references":["https://osv.dev/vulnerability/GO-2026-6567","https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f","https://nvd.nist.gov/vuln/detail/CVE-2026-63342","https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6567","url":"https://osv.dev/vulnerability/GO-2026-6567"}],"summary":"Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet"}