Affected by GO-2026-6560
and 1 other vulnerabilities
GO-2026-6560: Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet
GO-2026-6565: Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet
Command gen regenerates the embedded auth-disabled API token (keyset/token.jwt), signed with the
committed private keyset. Run from the repo root:
go run ./pkg/authmode/keyset/gen > pkg/authmode/keyset/token.jwt
The claims are fixed (see pkg/authmode/token.go) so the one token validates on every authdisabled
instance. Only rerun this if the keyset or those claims change.
Affected by 
Documentation
¶
Source Files