Hatchet's SNS UnsubscribeConfirmation handler allows an authenticated tenant to supply an arbitrary UnsubscribeURL after verifying the message payload even though the message signature does not cover that field. By replacing the URL with an internal address, the server performs a GET request to that location, creating a server‑side request forgery path that can reach internal services such as the EC2 Instance Metadata Service, other internal HTTP APIs, or any resource reachable from the Hatchet host. This can expose IAM credentials, internal data, and enable further internal actions. The attack requires control of a tenant that can send signed SNS messages to Hatchet but does not need elevated privileges beyond that tenant scope. The failure is a classic SSRF vulnerability identified as CWE‑918. The impact is the potential exfiltration of internal data and unintended interaction with internal services, although it does not directly grant higher system privileges.

The vulnerability exists in the Hatchet platform developed by hatchet‑dev. Versions earlier than 0.91.1 are affected. Any deployment of Hatchet that relies on the internal SNS ingestion module before the 0.91.1 update is at risk. The fix is incorporated in 0.91.1 and later releases, removing the use of UnsubscribeURL in HTTP requests after payload verification.

The CVSS score of 4.1 indicates low to moderate impact. Exploit probability is not documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no publicly observed exploitation yet. However, because only authenticated tenants can trigger the SSRF and the target is internal network resources, the risk to customers is significant for environments where the service has unrestricted outbound connectivity. The attacker can read instance metadata, access internal APIs, and potentially influence internal state within the tenant's scope. While the vulnerability does not automatically lead to tenant‑level privilege escalation, it can serve as a foothold for lateral movement if other weaknesses exist.