Is CVE-2026-61681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61681 being exploited in the wild.

How severe is CVE-2026-61681?

Medium severity, with a CVSS score of 4.1, published 21 September 2026.

Which products and versions are affected?

github.com/hatchet-dev/hatchet (Go) SEMVER:introduced=0; hatchet-dev/hatchet (Go) < 0.91.1, SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.

Is there a fix for CVE-2026-61681?

Yes. hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61681 attacked?

It is attacked over the network.

Am I affected by CVE-2026-61681?

Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61681: Hatchet SSRF in SNS UnsubscribeConfirmation handler

Q: Is there a fix for CVE-2026-61681?

Yes. hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61681 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-61681?

Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61681 · Severity: medium · CVSS 4.1 · Published 2026-09-21

Hatchet is a workflow orchestration platform that integrates with AWS SNS for event processing. An attacker with valid Hatchet and AWS credentials can inject a malicious URL into SNS unsubscribe messages, causing the Hatchet server to make unauthorized HTTP requests to internal services—including cloud metadata endpoints that expose IAM credentials, internal APIs, and other non-public infrastructure.

Technologies: github.com/hatchet-dev/hatchet (Go), Hatchet. Vendors: Go, Hatchet.

Quick answers

Is CVE-2026-61681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61681 being exploited in the wild.
How severe is CVE-2026-61681?: Medium severity, with a CVSS score of 4.1, published 21 September 2026.
Which products and versions are affected?: github.com/hatchet-dev/hatchet (Go) SEMVER:introduced=0; hatchet-dev/hatchet (Go) < 0.91.1, SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.
Is there a fix for CVE-2026-61681?: Yes. hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61681 attacked?: It is attacked over the network.
Am I affected by CVE-2026-61681?: Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet-dev/hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hatchet-dev/hatchet (Go): upgrade to 0.91.1 or later
```
go get hatchet-dev/hatchet@v0.91.1
```

Technical details

The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an unvalidated HTTP GET request to payload.UnsubscribeURL without any URL filtering. The UnsubscribeURL field is intentionally excluded from the AWS signature validation (BuildSignature() function), allowing an attacker to replace it with an arbitrary URL while the rest of the message remains cryptographically signed and valid. An authenticated attacker with an AWS account can craft a malicious SNS message and trigger SSRF, enabling access to EC2 Instance Metadata Service (IMDS) at 169.254.169.254, internal Kubernetes APIs, dashboards, and internal HTTP services. The vulnerability requires an attacker to have a valid Hatchet account and AWS Free Tier account. A fix was released in version 0.91.1.

Affected products

Hatchet Hatchet < 0.91.1

Identifiers

CVE-2026-61681
GHSA-fjwv-jf2v-j499
GO-2026-6565

Timeline

2026-06-30: disclosed: Published to GitHub Advisory Database
2026-06-30: patched: Fix released in version 0.91.1
2026-09-21: advisory: Published by National Vulnerability Database
2026-09-22: other: GitHub Advisory reviewed and updated

References

https://api.github.com/users/aslein1413-sys

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.