CVE-2026-61681

Executive Summary

CVE-2026-61681 is a server-side request forgery (SSRF) vulnerability (CWE-918) in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to version 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload(), even though BuildSignature() excludes UnsubscribeURL from the signed material. This allows an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed SNS message with an internal URL, causing the server to issue HTTP requests to attacker-chosen internal destinations. Impact is scoped to confidentiality (CVSS 4.1, C:L) with potential exposure of EC2 Instance Metadata Service (IMDS) credentials, internal services, and internal HTTP APIs; no integrity or availability impact is assessed.

Technical Analysis

The vulnerability resides in Hatchet's AWS SNS ingestor, specifically the UnsubscribeConfirmation message handler implemented in internal/integrations/ingestors/sns/sns.go. AWS SNS delivers subscription lifecycle notifications to subscribed HTTP/HTTPS endpoints, including UnsubscribeConfirmation messages. These messages are expected to carry a signature verifying authenticity, and Hatchet implements this via VerifyPayload(). The critical flaw is a mismatch between what is signed and what is used:

1. Signature scope: BuildSignature() — the routine that constructs the canonical string to be signed by AWS — explicitly excludes the UnsubscribeURL field. Therefore, UnsubscribeURL is not covered by the AWS signature.
2. Handler behavior: The UnsubscribeConfirmation handler nevertheless reads payload.UnsubscribeURL and passes it directly to http.Get() after VerifyPayload() has returned successfully.

Because signature verification cannot detect tampering with UnsubscribeURL (it is outside the signed material), an attacker who is an authenticated Hatchet tenant — and who can therefore submit a message to the ingestion endpoint that satisfies VerifyPayload() — can substitute an arbitrary URL in the UnsubscribeURL field. The server then performs a server-side HTTP GET to that URL.

This is a classic SSRF pattern (CWE-918): user-influenced input flows into a server-initiated request without destination validation. The trust boundary is crossed because the verification step provides a false sense of assurance — the payload is "validly signed" in the attacker's framing, yet the field that drives outbound network activity is not authenticated by that signature.

Attack surface: the SNS HTTP ingestion endpoint exposed by the Hatchet deployment. Any party capable of delivering a message that passes VerifyPayload() — which the NVD description characterizes as an "authenticated Hatchet tenant" — can exercise the flaw.

Preconditions summarized from the NVD description:

• Hatchet version < 0.91.1 (i.e., deployment running a vulnerable build).
• SNS ingestor enabled and reachable.
• Attacker holds a valid/authenticated tenant relationship enabling message submission to the ingestor.
• The submitted message must otherwise satisfy VerifyPayload() while carrying a modified UnsubscribeURL.

Notable absence of detail: the NVD description does not specify the exact signature scheme, the validation logic inside VerifyPayload(), whether redirects are followed by http.Get(), or what URL schemes/hosts are constrained. These specifics should not be assumed. The vulnerability class and mechanism above are fully derived from the provided description; no additional implementation details are asserted.

Exploitation Scenarios

The following attack chain is inferred from the NVD description and the SSRF vulnerability class. No public PoC exists, so the chain is described at the vulnerability-class level without fabricating implementation-specific artifacts.

1. Reconnaissance / target identification. The attacker identifies a Hatchet deployment running a version prior to 0.91.1 with the SNS ingestor reachable over the network. Because Hatchet is deployed as a self-hosted orchestration platform connected to cloud infrastructure, the target is valuable: the Hatchet server process likely runs in a cloud environment (e.g., EC2) with an attached IAM role.

2. Establishing a valid submission. The attacker operates as an authenticated Hatchet tenant, allowing them to send a message to the SNS ingestion endpoint that passes VerifyPayload(). Per the description, an "otherwise valid AWS-signed message" is the vehicle — the attacker takes a validly signed SNS message and alters the one field that the signature does not cover.

3. Triggering the flaw. The attacker replaces UnsubscribeURL in the UnsubscribeConfirmation payload with an internal URL — such as an EC2 Instance Metadata Service endpoint or an internal service address — and submits it. The UnsubscribeConfirmation handler accepts the message, VerifyPayload() succeeds (because UnsubscribeURL is outside the signed material per BuildSignature()), and the handler then calls http.Get() on the attacker-supplied UnsubscribeURL. The vulnerable server issues the request from inside the trusted network perimeter.

4. Post-exploitation impact. The server-side GET reaches internal-only resources that are unreachable to the attacker directly. The NVD description explicitly names the EC2 Instance Metadata Service, internal services, and internal HTTP APIs as reachable targets. This can expose IAM credentials (via IMDS) or network-accessible data and functionality. Exfiltrated IAM credentials could enable lateral movement or privilege escalation within the cloud account; internal API responses could reveal further attack surface. Note that CVSS rates confidentiality impact Low with scope changed, and no integrity or availability impact — consistent with read-oriented SSRF.

Impact Assessment

CVSS 3.1 score 4.1 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N. Breakdown of the assessed subscores:

• AV:N (Network): the SNS ingestion endpoint is network-reachable.
• AC:L (Low): no unusual conditions beyond holding an authenticated tenant position.
• PR:H (High): requires authenticated tenant privileges to submit a message that passes verification.
• UI:N (None): no user interaction required.
• S:C (Changed): the exploited component (Hatchet's handler) causes impact to resources beyond its own security scope — the internal network and metadata service it can reach.
• C:L (Low): confidential data exposure is possible but limited in scope per the score.
• I:N / A:N: no assessed integrity or availability impact.

Business impact: Hatchet orchestrates background tasks, AI agents, and durable workflows, so its server process commonly holds credentials for cloud resources, internal APIs, and downstream services. A successful SSRF can pivot the attacker's reach from the public ingestion endpoint into the internal network and IMDS, potentially yielding IAM credentials — a stepping stone to cloud account compromise. Blast radius is bounded by what the Hatchet server's network position and instance role can access; in cloud deployments this frequently includes metadata services and internal control-plane APIs. The High privilege requirement and Low confidentiality rating temper the score, but the Changed scope indicates the security-relevant effect extends beyond Hatchet itself.

Affected systems: deployments of Hatchet prior to 0.91.1 with the SNS ingestor enabled. No specific affected version range beyond the NVD-stated "prior to 0.91.1" is provided, and no OSV package mappings are available.

Detection Guidance

Sigma Rule

title: Potential SSRF via Hatchet SNS UnsubscribeConfirmation Handler (CVE-2026-61681)
id: 7f3b9c2a-4d1e-4a5b-9c6e-1b2d3f4a5c6d
status: experimental
description: Detects outbound HTTP requests originating from Hatchet to internal/private address space or cloud metadata endpoints, consistent with SSRF exploitation via the SNS UnsubscribeConfirmation handler.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61681
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.918
logsource:
  category: network_connection
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/hatchet'
      - '/hatchet-api'
      - '/hatchet-engine'
  selection_dest:
    DestinationIp|cidr:
      - '169.254.169.254/32'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection_proc and selection_dest
falsepositives:
  - Legitimate Hatchet workflow tasks calling internal services
level: medium

YARA Rule

rule CVE_2026_61681_Hatchet_SNS_SSRF
{
    meta:
        description = "Detects Hatchet SNS ingestor artifacts referencing the vulnerable UnsubscribeConfirmation handler behavior"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61681"
        date = "2026-01-01"
        cve = "CVE-2026-61681"

    strings:
        $s1 = "UnsubscribeConfirmation" ascii wide
        $s2 = "UnsubscribeURL" ascii wide
        $s3 = "BuildSignature" ascii wide
        $s4 = "VerifyPayload" ascii wide
        $s5 = "internal/integrations/ingestors/sns/sns.go" ascii wide

    condition:
        uint32(0) == 0x464c457f and 2 of ($s1, $s2, $s3, $s4, $s5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61681 Hatchet SNS UnsubscribeConfirmation SSRF - UnsubscribeURL to Internal Target"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"sns"; nocase; http.request_body; content:"UnsubscribeConfirmation"; nocase; http.request_body; pcre:"/UnsubscribeURL[^,}]{0,64}(169\.254\.169\.254|127\.0\.0\.1|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/i"; reference:cve,2026-61681; classtype:attempted-recon; sid:202661681; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name in ("hatchet", "hatchet-api", "hatchet-engine")]
  [network where cidr_match(destination.ip,
      "169.254.169.254/32", "127.0.0.0/8", "10.0.0.0/8",
      "172.16.0.0/12", "192.168.0.0/16")
   and network.direction == "outbound"]

Splunk SPL Query

index=network OR index=proxy
| search process_name IN ("hatchet","hatchet-api","hatchet-engine")
| search (dest_ip="169.254.169.254" OR dest_ip="127.0.0.1"
          OR cidrmatch("10.0.0.0/8", dest_ip)
          OR cidrmatch("172.16.0.0/12", dest_ip)
          OR cidrmatch("192.168.0.0/16", dest_ip))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(dest_ip) as destinations values(dest_port) as ports
        by src_ip process_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="hatchet,ssrf,cve-2026-61681,">
  <rule id="202661" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">hatchet|hatchet-api|hatchet-engine</field>
    <field name="destination.ip">169\.254\.169\.254|127\.0\.0\.1|^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.</field>
    <description>CVE-2026-61681: Hatchet process made outbound request to internal/metadata address - possible SNS SSRF exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_61681,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is currently tracked. The only version guidance available is the NVD statement that the issue is "fixed in version 0.91.1." Treat all guidance below as precautionary.

1. Immediate mitigations

   • Upgrade to Hatchet 0.91.1 or later if an official artifact for that version is available from the vendor; NVD identifies 0.91.1 as the fixed release. Verify provenance of any binary/container before deploying, given the absence of tracked patch evidence.
   • Disable or restrict the SNS ingestor if it is not required, removing the attack surface entirely.
   • Restrict ingress to the SNS ingestion endpoint to trusted AWS SNS source ranges and require strong tenant authentication.
   • Enforce egress filtering from the Hatchet server so it cannot reach the EC2 Instance Metadata Service (block 169.254.169.254) or internal address space except where explicitly required.
   • Use IMDSv2 (token-required, hop-limited) on the underlying instance to reduce the value of any SSRF that reaches IMDS.
   • Apply least privilege to the Hatchet instance role to limit credential exposure if SSRF succeeds.

2. Patch / upgrade steps

   • Monitor the Hatchet project's official repository and release notes for the 0.91.1 release and any subsequent security advisories.
   • Once a trusted patch is available, test in a staging environment, then roll out to production deployments running versions prior to 0.91.1.
   • Because patch confidence is 0/4, do not assume any advisement is authoritative until corroborated against the vendor's own release channel.

3. Long-term hardening

   • Validate and allow-list outbound request destinations in the SNS ingestor; never call http.Get() on URL fields that are excluded from signature verification.
   • Ensure all fields that drive server-side behavior are included in BuildSignature() and covered by VerifyPayload().
   • Adopt a general SSRF-safe HTTP client (no redirects to internal ranges, DNS rebinding protections, scheme allow-listing).
   • Run Hetchet workloads with least-privilege network policies and metadata access controls.

References

• NVD — CVE-2026-61681: https://nvd.nist.gov/vuln/detail/CVE-2026-61681
• CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• AWS documentation — Instance Metadata Service (IMDS) and IMDSv2 configuration guidance
• Hatchet project repository and release notes (verify the 0.91.1 release directly from the vendor)

No public PoC, exploit code, or Nuclei template is known at this time. CVE-2026-61681 is not listed in CISA KEV. No threat actor campaigns or in-the-wild exploitation have been reported.