[ CVE-2026-61681 · Published 21 Sep 2026 ]
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
CVSS 4.1
EPSS <1%Fix available
[ Description ]Official description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
[ Fixes ]Fixes and patches
- hatchet-dev/hatchet 0.91.1Fixed version · GitHub Advisories · go package hatchet-dev/hatchet: upgrade to 0.91.1 or later (affected < 0.91.1)
[ Packages ]Affected open-source packages
- hatchet-dev/hatchet goAffected < 0.91.1 · fixed in 0.91.1 · GHSA-fjwv-jf2v-j499