Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Summary The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go makes an unvalidated http.Get call to payload.UnsubscribeURL without any URL restriction. Because UnsubscribeURL is intentionally excluded from the BuildSignature signed field list, an attacker can repla...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...