CVE-2026-61681: Hatchet-Dev Hatchet

Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.

Affected products

• Hatchet-Dev Hatchet: before 0.91.1 (fixed in 0.91.1)

Published 2026-09-21. Last modified 2026-09-24.