Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-21T16:17:09.823Z",
  "pubdate": "2026-09-21T16:17:09.823Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Hatchet versions prior to 0.91.1 within the SNS UnsubscribeConfirmation handler. The vulnerability stems from the insecure handling of the 'UnsubscribeURL' field during the processing of AWS SNS messages. An authenticated tenant can manipulate the 'UnsubscribeURL' parameter within an otherwise valid, cryptographically signed AWS SNS payload. When the application processes this input, it initiates an unsanitized HTTP GET request to the attacker-controlled URI.\nThis flaw allows an authenticated attacker to perform SSRF attacks against the host environment. The impact includes the potential exposure of sensitive internal infrastructure, such as the EC2 Instance Metadata Service (IMDS), internal microservices, and private HTTP APIs. Successful exploitation could lead to the exfiltration of IAM credentials, internal network mapping, and unauthorized access to restricted internal resources. The vulnerability requires the attacker to be an authenticated Hatchet tenant, leveraging the system's intended integration functionality to redirect server-side traffic to arbitrary internal endpoints.",
  "technicalDetails": "The vulnerability is located in 'internal/integrations/ingestors/sns/sns.go'. The root cause is a logic flaw in the message verification process where the 'UnsubscribeURL' field is excluded from the signature validation process performed by 'BuildSignature()'. Despite the payload undergoing verification via 'VerifyPayload()', the subsequent execution of 'http.Get()' on the attacker-supplied 'UnsubscribeURL' occurs without sufficient validation or URI restriction.\nThe attack flow proceeds as follows: First, an authenticated Hatchet tenant crafts a malformed SNS message. While the tenant maintains a valid signature for the primary body of the message, they inject an arbitrary URL into the 'UnsubscribeURL' field, which is explicitly ignored by the 'BuildSignature()' verification routine. When the 'UnsubscribeURL' handler processes this object, the Hatchet server interprets the field as a legitimate AWS callback URL and initiates an HTTP GET request to the specified destination.\nBecause the Hatchet application operates within the network boundary of the host environment, the resulting GET request is performed from the perspective of the server. This allows the attacker to bypass network perimeter defenses and interact with services that expect traffic only from local or internal sources. Common targets include the AWS IMDS (typically accessible at 169.254.169.254), which may return temporary security credentials associated with the instance's IAM role, or internal administrative endpoints that lack additional authentication because they rely on network-level trust.\nThe vulnerability is present in all Hatchet versions prior to 0.91.1. It is critical to note that the verification performed by 'VerifyPayload()' provides a false sense of security; because the security-sensitive URL field is excluded from the cryptographic signature, the application treats untrusted input as a trusted instruction. Exploitation is contingent upon the attacker's ability to successfully authenticate as a tenant within the Hatchet platform, but the subsequent post-exploitation impact allows for severe privilege escalation via the exfiltration of cloud provider credentials or sensitive internal data."
}