PkgSeer

Vulnerability GO-2026-6565

Unknown

6 hours ago

Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet

v0.0.0 - v0.109.21-alpha.0

Summary

Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet

Details

Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/hatchet-dev/hatchet before v0.91.1.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

v0.0.0 - v0.106.0 GO-2026-6560

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher in github.com/hatchet-dev/hatchet

v0.0.0 - v0.95.2 GO-2026-6561

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check in github.com/hatchet-dev/hatchet

v0.0.0 - v0.91.0 GO-2026-6567

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState in hatchet in github.com/hatchet-dev/hatchet

v0.0.0 - v0.109.21-alpha.0 GO-2026-6535

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter

v0.0.0 - v0.106.0 GHSA-992g-9cr3-vm5x

View all vulnerabilities for these packages

Impacted packages

github.com/hatchet-dev/hatchet

Timeline

Published

6 hours ago

Last Modified

6 hours ago