CVE-2026-61681
MediumCVSS 4.1Summary
Hatchet before version 0.91.1 has an SSRF vulnerability in the SNS UnsubscribeConfirmation handler. An authenticated tenant can replace the UnsubscribeURL field in a valid AWS-signed message with an internal URL, allowing server-side requests to EC2 Instance Metadata Service, internal services, and internal HTTP APIs. This may expose IAM credentials or network-accessible data and functionality.
Risk Assessment
An attacker with tenant access can reach internal resources, including cloud credentials, potentially leading to full environment compromise.
Recommendation
Upgrade Hatchet to version 0.91.1 or later, which includes the fix.
Other vulnerabilities in Hatchet
See all- CVE-2026-88978Medium
Hatchet prior to version 0.106.1 lacks a tenant filter in the WorkerStatus gRPC polling path in pkg/repository/durable_events.go. An authenticated tenant worker, knowing another tenant's durable-task UUID, can retrieve matching durable event-log records, leading to cross-tenant data leakage.
- CVE-2026-84298Low
Hatchet prior to 0.95.3 stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload.
- CVE-2026-63342Medium
Hatchet prior to version 0.91.1 lacks a tenant check in the API endpoint GET /api/v1/stable/durable-tasks/{durable-task} defined in api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml. An authenticated user who obtains another tenant's durable task UUID can read that task's event log, including task display names, workflow identifiers, user messages, wait conditions, and branching logic.
- CVE-2026-61687High
In Hatchet prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity.
- CVE-2026-54746Medium
Hatchet from 0.40.0 until 0.91.1 does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher.
Original NVD description (English source)
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.