{"id":"CVE-2026-61681","revision":"298b98f7535b4b02802609605ac63aed","records":[{"revision":"298b98f7535b4b02802609605ac63aed","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61681","aliases":[],"title":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","state":0,"publishedAt":"2026-09-21T15:42:21.803+00:00","modifiedAt":"2026-09-24T22:17:06.909+00:00","affected":[{"ecosystem":"Vendor product","name":"hatchet","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"hatchet-dev\",\n                    \"product\": \"hatchet\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.91.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","score":4.1,"severity":"MEDIUM"}],"references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499","https://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61681","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61681","identifiers":["CVE-2026-61681"]},"retained":false,"historicalAffected":[]}],"coverage":[]}