CVE-2026-61681: Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hatchetto a version that resolves this vulnerability.Fixed in 0.91.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Hatchet tenant can exploit it by modifying the UnsubscribeURL field in an otherwise valid AWS-signed SNS UnsubscribeConfirmation message. The attacker does not need to forge the SNS signature because that field is excluded from the signature calculation.
Which deployments are affected?
Hatchet versions prior to 0.91.1 are affected where the SNS UnsubscribeConfirmation handler is reachable and processes these messages. The issue is fixed in version 0.91.1.
What could an attacker access through the SSRF?
The Hatchet server can be induced to make HTTP requests to EC2 Instance Metadata Service, internal services, or internal HTTP APIs reachable from the server. This may expose IAM credentials, internal data, or network-accessible functionality.
How can I tell whether exploitation may have occurred?
Review requests handled by the SNS UnsubscribeConfirmation path for unexpected UnsubscribeURL values, particularly URLs targeting link-local metadata addresses or internal hosts. Also review outbound HTTP activity from Hatchet instances for requests to internal-only services that correspond to unsubscribe confirmation processing.