CVE-2026-61681

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1

Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get() request on the UnsubscribeURL parameter within the payload. Because the BuildSignature() function excludes UnsubscribeURL, an authenticated tenant can modify this field in a valid AWS-signed message to point to an internal URL. This allows for server-side requests to reach the EC2 Instance Metadata Service, internal services, and internal HTTP APIs, which could lead to the exposure of IAM credentials or internal network data and functionality.

Recommendations Update to version 0.91.1.