{"id":"EUVD-2026-83976","enisaUuid":"b7383ba5-68b4-3f80-b236-00519b6da04f","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","datePublished":"Sep 21, 2026, 3:42:21 PM","dateUpdated":"Sep 24, 2026, 10:17:06 PM","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499\nhttps://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98\n","aliases":"CVE-2026-61681\nGHSA-fjwv-jf2v-j499\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"41198487-2097-37a3-aad6-00281e75fcba","product":{"name":"hatchet","vendor":{"name":"hatchet-dev"}},"product_version":"\u003c 0.91.1"}],"enisaIdVendor":[{"id":"7acb084a-53d8-3f27-b708-fef1a20cc778","vendor":{"name":"hatchet-dev"}}],"enisaIdVulnerability":[{"id":"1a04b1f7-5e43-3a86-9ec2-9382dc674dc3","vulnerability":{"id":"CVE-2026-61681","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.","datePublished":"Sep 21, 2026, 3:42:21 PM","dateUpdated":"Sep 24, 2026, 10:17:06 PM","status":"PUBLISHED","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","references":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499\nhttps://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98\n","enisa_id":"EUVD-2026-83976\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 9, 2026, 3:07:47 PM","vulnerabilityProduct":[{"id":"cb008876-906a-3f76-b35e-9df2e56c1be8","product":{"name":"hatchet","vendor":{"name":"hatchet-dev"}},"product_version":"\u003c 0.91.1"}],"vulnerabilityVendor":[{"id":"26088849-213c-33bf-ba7b-f67965155fa1","vendor":{"name":"hatchet-dev"}}]}},{"id":"62b16986-dc2e-3f1f-894f-7a7800ea4481","vulnerability":{"id":"GHSA-fjwv-jf2v-j499","description":"Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler","datePublished":"Sep 22, 2026, 8:34:12 PM","dateUpdated":"Nov 4, 2026, 11:32:48 PM","baseScore":0.0,"references":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-fjwv-jf2v-j499\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-61681\nhttps://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98\nhttps://github.com/hatchet-dev/hatchet\n","enisa_id":"EUVD-2026-83976\n","aliases":"GHSA-fjwv-jf2v-j499\nCVE-2026-61681\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}