{"id":"CVE-2026-61681","revision":"72293e09956d4bdd96498343ded457ed","records":[{"revision":"72293e09956d4bdd96498343ded457ed","observedAt":"2026-10-25T14:19:22.811+00:00","statement":{"source":"nvd","id":"CVE-2026-61681","aliases":[],"title":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.Unsubscr…","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","state":0,"publishedAt":"2026-09-21T16:17:09.823+00:00","modifiedAt":"2026-09-24T23:17:13.4+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","score":4.1,"severity":"MEDIUM"}],"references":["https://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98","https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61681","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-09-21T16:17:09.823","lastModified":"2026-09-24T23:17:13.400"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-61681","identifiers":["CVE-2026-61681"]},"retained":false,"historicalAffected":[]}],"coverage":[]}