CVE-2026-61681: falha de média gravidade em hatchet-dev hatchet
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.1epss 0.3%
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
hatchet-dev · hatchetCVEs relacionadas — hatchet-dev hatchet
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-108755MEDIUMHatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion EndpointEPSS 0.3%CVE-2026-63342MEDIUMHatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckEPSS 0.3%CVE-2026-88978MEDIUMHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterEPSS 0.3%CVE-2026-84298LOWHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherEPSS 0.2%CVE-2026-42572MEDIUMHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`EPSS 0.2%