Hatchet vulnerability allows cross-tenant DoS via Dispatcher gRPC

According to the GitHub Security Advisory database, Hatchet has disclosed a medium-severity vulnerability (GHSA-8x7x-83cf-c3pg) affecting the Dispatcher gRPC service. This issue allows holders of low-privilege tenant-scoped API tokens to perform cross-tenant write or denial-of-service (DoS) attacks against other tenants' workers on the same Hatchet instance. The vulnerability stems from the affected RPCs, `Dispatcher/UpsertWorkerLabels` and `Dispatcher/Unsubscribe`, which fail to authorize the `worker_id` in the request body against the tenant context derived from the bearer token.

The impact is limited to multi-tenant deployments, including Hatchet Cloud, self-hosted instances shared by multiple teams, or any setup where an attacker can obtain a tenant API token. Single-tenant deployments are not practically affected, as the attacker and victim would belong to the same tenant.

Operators should carefully evaluate their deployment model before upgrading or applying mitigations. If running a multi-tenant instance, they should audit API token access and ensure that low-privilege tokens are not exposed, especially in CI/CD pipelines. Additionally, operators should confirm whether their instance hosts multiple tenants, as single-tenant setups are not vulnerable to this issue. This vulnerability highlights the importance of rigorous tenant isolation in multi-tenant architectures, a challenge seen across many cloud-native projects.