https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:42:30 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-61681 <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.</p> <p>Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-61681 https://vulnerability.circl.lu/vuln/ghsa-fjwv-jf2v-j499 <p><strong>Affected:</strong> Go: hatchet-dev/hatchet</p> <p>### Summary The SNS `UnsubscribeConfirmation` handler in `internal/integrations/ingestors/sns/sns.go` makes an unvalidated `http.Get()` call to `payload.UnsubscribeURL` without any URL restriction. Because `UnsubscribeURL` is intentionally excluded from the `BuildSignature()` signed field list, an attacker can replace this field in a legitimately AWS-signed message with an arbitrary internal URL, bypassing the `VerifyPayload()` signature check entirely and triggering a Server-Side Request Forgery (SSRF) against internal infrastructure — including the EC2 Instance Metadata Service (IMDS) at `169.254.169.254`.</p> <p>### Impact</p> <p>This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker with a Hatchet account and an AWS Free Tier account can:</p> <p>- Reach the EC2 IMDS endpoint and retrieve IAM temporary credentials if Hatchet is deployed on AWS - Port-scan and probe internal services not exposed to the internet - Access internal HTTP APIs (e.g., Kubernetes API server, internal dashboards) from the Hatchet server&#39;s network context</p> <p><strong>Affected:</strong> Go: hatchet-dev/hatchet</p> <p>### Summary The SNS `UnsubscribeConfirmation` handler in `internal/integrations/ingestors/sns/sns.go` makes an unvalidated `http.Get()` call to `payload.UnsubscribeURL` without any URL restriction. Because `UnsubscribeURL` is intentionally excluded from the `BuildSignature()` signed field list, an attacker can replace this field in a legitimately AWS-signed message with an arbitrary internal URL, bypassing the `VerifyPayload()` signature check entirely and triggering a Server-Side Request Forgery (SSRF) against internal infrastructure — including the EC2 Instance Metadata Service (IMDS) at `169.254.169.254`.</p> <p>### Impact</p> <p>This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker with a Hatchet account and an AWS Free Tier account can:</p> <p>- Reach the EC2 IMDS endpoint and retrieve IAM temporary credentials if Hatchet is deployed on AWS - Port-scan and probe internal services not exposed to the internet - Access internal HTTP APIs (e.g., Kubernetes API server, internal dashboards) from the Hatchet server&#39;s network context</p> https://vulnerability.circl.lu/vuln/ghsa-fjwv-jf2v-j499