{"id":"CVE-2026-61681","aliases":["EUVD-2026-83976","GHSA-fjwv-jf2v-j499","GO-2026-6565"],"status":"published","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00311,"percentile":0.24258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-09-21T15:42:21Z","modified":"2026-11-04T23:45:05Z","fixes":[{"ecosystem":"Go","package":"github.com/hatchet-dev/hatchet","fixed_in":["0.91.1","0.91.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hatchet-dev/hatchet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.91.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hatchet-dev/hatchet","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.91.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hatchet-dev/hatchet","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.91.2"}]}]}],"products":[{"vendor":"hatchet-dev","product":"hatchet"}],"references":[{"url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61681","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fjwv-jf2v-j499"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61681.json","tags":["advisory"]},{"url":"https://github.com/hatchet-dev/hatchet","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-61681","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","status":"published","published":"2026-09-21T15:42:21.803Z","modified":"2026-09-24T22:17:06.909Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:19:53.4444Z"}],"euvd":[{"id":"EUVD-2026-83976","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","status":"published","published":"2026-09-21T15:42:21Z","modified":"2026-09-24T22:17:06Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:56.296478Z"}],"ghsa":[{"id":"GHSA-fjwv-jf2v-j499","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"### Summary\n  The SNS `UnsubscribeConfirmation` handler in `internal/integrations/ingestors/sns/sns.go` makes an unvalidated\n  `http.Get()` call to `payload.UnsubscribeURL` without any URL restriction. Because `UnsubscribeURL` is intentionally\n  excluded from the `BuildSignature()` signed field list, an attacker can replace this field in a legitimately\n  AWS-signed message with an arbitrary internal URL, bypassing the `VerifyPayload()` signature check entirely and\n  triggering a Server-Side Request Forgery (SSRF) against internal infrastructure — including the EC2 Instance Metadata\n  Service (IMDS) at `169.254.169.254`.\n\n ### Impact\n\n  This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker with a Hatchet account and an AWS Free Tier\n  account can:\n\n  - Reach the EC2 IMDS endpoint and retrieve IAM temporary credentials if Hatchet is deployed on AWS\n  - Port-scan and probe internal services not exposed to the internet\n  - Access internal HTTP APIs (e.g., Kubernetes API server, internal dashboards) from the Hatchet server's network\n  context","status":"published","published":"2026-09-22T20:34:12Z","modified":"2026-11-04T23:32:52Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-04T23:40:16.825835Z"}],"nvd":[{"id":"CVE-2026-61681","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","status":"published","published":"2026-09-21T16:17:09.823Z","modified":"2026-09-24T23:17:13.4Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:50.368368Z"}],"osv":[{"id":"CVE-2026-61681","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","status":"published","published":"2026-09-21T15:42:21.803Z","modified":"2026-10-28T02:30:29.534744504Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"GHSA-fjwv-jf2v-j499","title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"### Summary\n  The SNS `UnsubscribeConfirmation` handler in `internal/integrations/ingestors/sns/sns.go` makes an unvalidated\n  `http.Get()` call to `payload.UnsubscribeURL` without any URL restriction. Because `UnsubscribeURL` is intentionally\n  excluded from the `BuildSignature()` signed field list, an attacker can replace this field in a legitimately\n  AWS-signed message with an arbitrary internal URL, bypassing the `VerifyPayload()` signature check entirely and\n  triggering a Server-Side Request Forgery (SSRF) against internal infrastructure — including the EC2 Instance Metadata\n  Service (IMDS) at `169.254.169.254`.\n\n ### Impact\n\n  This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker with a Hatchet account and an AWS Free Tier\n  account can:\n\n  - Reach the EC2 IMDS endpoint and retrieve IAM temporary credentials if Hatchet is deployed on AWS\n  - Port-scan and probe internal services not exposed to the internet\n  - Access internal HTTP APIs (e.g., Kubernetes API server, internal dashboards) from the Hatchet server's network\n  context","status":"published","published":"2026-09-22T20:34:12Z","modified":"2026-11-04T23:45:05.748429348Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-05T00:11:21.164934Z"},{"id":"GO-2026-6565","title":"SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet","description":"SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-07T17:45:13.266364215Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}