Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M
CVE-2026-61681Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Medium 4.1
In plain English
A medium-severity server-side request forgery in hatchet from hatchet-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hatchet-dev/hatchet | 0.91.1 | GHSA-fjwv-jf2v-j499 |
| Go | github.com/hatchet-dev/hatchet | 0.91.2 | GO-2026-6565 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hatchet-dev | hatchet | < 0.91.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N