Cross-tenant disclosure risk on DurableTask bidi RPC

This is a low-severity, low-risk cross-tenant data exposure vuln caused by blindly accepting a durable task id, in addition to a list of node and branch ids that identify records in that task's event log, and returning them to the caller via the handleWorkerStatus polling path.

Impact

This advisory requires an attacker to successfully guess a durable task's external uuid belonging to another tenant. External ids are generated uuid v4s (uuid.New() in Go), so exploitation requires prior knowledge of a target task UUID through an out-of-band channel. Thus, while the following environments are impacted, there is an extremely low probability it would be exploited.

Who is impacted. Any Hatchet deployment that hosts more than one tenant on the same instance:

• Hatchet Cloud (multi-tenant SaaS)
• Self-hosted Hatchet with multiple internal teams / business units sharing one instance
• Any deployment where a single tenant's API token can be obtained by an attacker

Single-tenant self-hosted deployments are unaffected in practice (the "victim" and "attacker" tenants would be the same).