THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8x7x-83cf-c3pg (medium) — Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

[GHSA] GHSA-8x7x-83cf-c3pg (medium) — Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

medgithub_advisoriesPublished 2026-08-28

GHSA-8x7x-83cf-c3pg Severity: medium CVE: CVE-2026-54746

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

### Summary

A **cross-tenant write / DoS** vulnerability in the Hatchet `Dispatcher` gRPC service allows any holder of a normal tenant-scoped API token (the lowest credential Hatchet issues — an `OWNER` of a brand-new ten

Indicators of compromise

CVE-2026-54746cve

Original source: https://github.com/advisories/GHSA-8x7x-83cf-c3pg