CVE-2026-61681: Hatchet Platform SSRF Vulnerability

CVE-2026-61681 Overview

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. A Server-Side Request Forgery (SSRF) vulnerability affects Hatchet versions prior to 0.91.1. The flaw resides in the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go, which calls http.Get() on payload.UnsubscribeURL after VerifyPayload(). Because BuildSignature() excludes UnsubscribeURL, an authenticated Hatchet tenant can substitute that field in an otherwise valid AWS-signed message with an internal URL. The issue is fixed in version 0.91.1.

Critical Impact
An authenticated tenant can coerce the Hatchet server to issue HTTP requests to internal services, including the EC2 Instance Metadata Service (IMDS), potentially exposing IAM credentials and internal HTTP APIs.

Affected Products

Hatchet (hatchet-dev/hatchet) versions prior to 0.91.1
Component: internal/integrations/ingestors/sns/sns.go
Deployments integrating AWS SNS ingestion with Hatchet

Discovery Timeline

2026-09-21 - CVE-2026-61681 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61681

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery flaw classified under [CWE-918]. Hatchet accepts AWS SNS notifications and verifies their authenticity using an AWS-signed payload. However, the signature construction in BuildSignature() covers only a subset of message fields and omits UnsubscribeURL. When the SNS UnsubscribeConfirmation handler processes a request, it calls http.Get(payload.UnsubscribeURL) directly after verification passes.

An authenticated tenant can craft an otherwise valid, AWS-signed SNS message and rewrite the UnsubscribeURL field to point to an internal endpoint. The signature verification succeeds because that field is not part of the signed data, and the server then issues an outbound HTTP GET to the attacker-controlled target.

Root Cause

The root cause is a mismatch between the fields covered by signature verification and the fields consumed by outbound HTTP logic. VerifyPayload() trusts the signed portion of the message, but downstream code dereferences an unsigned, tenant-influenced URL without validating its scheme, host, or destination.

Attack Vector

Exploitation requires an authenticated Hatchet tenant with access to submit SNS ingestion payloads. The attacker replaces UnsubscribeURL with a URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ to reach EC2 IMDS, or with internal service URLs to probe network-accessible APIs. Responses may expose IAM credentials, internal service data, or trigger state-changing GET endpoints.

// Patch: validateSNSURL added in internal/integrations/ingestors/sns/sns.go
// Source: https://github.com/hatchet-dev/hatchet/commit/2d211bce16e5022afaf95780de82dc30e0bcba98

// validateSNSURL ensures that a URL provided in an SNS payload points to a
// legitimate AWS SNS endpoint over HTTPS before it is used to make an outbound
// HTTP request. This prevents Server-Side Request Forgery (SSRF) via fields
// such as UnsubscribeURL, which are not covered by the signature in
// BuildSignature() and can therefore be tampered with on an otherwise valid
// AWS-signed message.
func validateSNSURL(rawURL string) error {
    if rawURL == "" {
        return errors.New("URL is empty")
    }

    parsedURL, err := url.Parse(rawURL)
    if err != nil {
        return err
    }

    if parsedURL.Scheme != "https" {
        return fmt.Errorf("url should be using https")
    }

    if !hostPattern.Match([]byte(parsedURL.Host)) {
        return fmt.Errorf("url is located on an invalid domain")
    }

    return nil
}

The patch enforces HTTPS and restricts the destination host to a known AWS SNS domain pattern before any outbound request is issued. See the GitHub Security Advisory GHSA-fjwv-jf2v-j499 for advisory details.

Detection Methods for CVE-2026-61681

Indicators of Compromise

Outbound HTTP requests from the Hatchet server to 169.254.169.254 (EC2 IMDS) or link-local addresses.
Outbound requests from Hatchet to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) not associated with legitimate integrations.
SNS UnsubscribeConfirmation payloads whose UnsubscribeURL host does not match sns.<region>.amazonaws.com.
Non-HTTPS UnsubscribeURL values in ingested SNS messages.

Detection Strategies

Inspect Hatchet application logs for http.Get calls originating from the SNS ingestor pointing to non-AWS hosts.
Correlate tenant identifiers with anomalous outbound HTTP destinations from the Hatchet workload.
Alert on any HTTP 200 responses returned from 169.254.169.254 to Hatchet server processes.

Monitoring Recommendations

Enable VPC Flow Logs on the Hatchet host subnet and alert on egress to metadata IP ranges.
Enforce IMDSv2 on EC2 instances hosting Hatchet to require session tokens for metadata access.
Monitor AWS CloudTrail for unexpected use of the Hatchet instance role, especially AssumeRole or credential-based API calls from unusual sources.

How to Mitigate CVE-2026-61681

Immediate Actions Required

Upgrade Hatchet to version 0.91.1 or later immediately.
Rotate any IAM credentials associated with the Hatchet host role if IMDS exposure is suspected.
Audit tenant activity for suspicious SNS ingestion payloads submitted before the upgrade.
Restrict network egress from the Hatchet server to only required external destinations.

Patch Information

The vulnerability is fixed in Hatchet 0.91.1. The patch introduces the validateSNSURL function in internal/integrations/ingestors/sns/sns.go, which enforces HTTPS and validates the host against an approved AWS SNS domain pattern before issuing outbound requests. Review the GitHub commit for the exact code change.

Workarounds

Enforce IMDSv2 on all EC2 instances hosting Hatchet to require session-token headers for metadata access.
Apply egress network policies (security groups, NACLs, or service mesh rules) blocking Hatchet from reaching 169.254.169.254 and internal management APIs.
Temporarily disable the SNS ingestion integration if upgrading is not immediately possible.
Restrict tenant permissions for SNS payload submission to trusted principals only.

bash

# Example: enforce IMDSv2 on the EC2 instance running Hatchet
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled

# Example: block Hatchet container egress to IMDS via iptables
iptables -A OUTPUT -d 169.254.169.254 -j DROP