{"data":{"id":"2c5ab53c-fb2b-4c83-8dc0-db1ca130a7ec","title":"CVE-2026-61681: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1…","summary":"Hatchet, a platform for orchestrating background tasks, AI agents and durable workflows, prior to 0.91.1 has a flaw in the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go. The handler calls http.Get() on payload.UnsubscribeURL after VerifyPayload(), but BuildSignature() excludes that field, so an authenticated tenant can replace it with an internal URL in an otherwise valid AWS-signed message. The resulting server-side request can reach the EC2 Instance Metadata Service, internal services and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality.","solution":"Fixed in 0.91.1","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61681","publishedAt":"2026-09-21T16:17:09.823Z","cveId":"CVE-2026-61681","cweIds":["CWE-918"],"cvssScore":"4.1","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["hatchet-dev/hatchet@< 0.91.1 (fixed: 0.91.1)"],"affectedPackageNames":["hatchet-dev/hatchet"],"affectedPackageRefs":["go:hatchet-dev/hatchet"],"affectedVendors":[],"affectedVendorsRaw":["Hatchet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hatchet SNS subscription handler server-side request forgery via UnsubscribeURL","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00311,"epssCheckedAt":"2026-11-10T06:09:41.675Z","kevDateAdded":null,"advisoryAliases":["GHSA-fjwv-jf2v-j499"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:28.564Z","patchAvailable":true,"disclosureDate":"2026-09-21T16:17:09.823Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T00:07:39.450Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"hatchet-dev/hatchet","fixedVersion":"0.91.1","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-11-06T00:07:39.445Z"}]}}