Hatchet DurableTask WorkerStatus gRPC cross-tenant data exposure risk

The Hatchet project has disclosed a medium-severity vulnerability in its DurableTask WorkerStatus gRPC mechanism, as detailed in the GitHub Security Advisory database. The issue arises from the `handleWorkerStatus` polling path, which resolves caller-supplied durable-task UUIDs without filtering by tenant_id. This creates a cross-tenant disclosure risk where an attacker could access another tenant's event log entries by guessing a valid UUID. However, exploitation requires prior knowledge of a target UUID, which is a v4 UUID generated using Go's `uuid.New()` method, making the likelihood of successful attacks extremely low.

Operators running Hatchet in multi-tenant environments, such as Hatchet Cloud or self-hosted instances shared by multiple teams, should evaluate their exposure to this vulnerability. Single-tenant deployments are effectively unaffected, as the attacker and victim would belong to the same tenant. Before upgrading or applying mitigations, operators should confirm whether their deployment hosts multiple tenants and assess whether tenant API tokens could be exposed through other channels. This advisory highlights the importance of verifying tenant isolation mechanisms, a recurring theme in multi-tenant SaaS security.