The Hatchet SNS UnsubscribeConfirmation handler contains a Server-Side Request Forgery (SSRF) vulnerability due to an unvalidated HTTP GET request to an unsigned UnsubscribeURL field. This allows an attacker to bypass signature verification and make arbitrary internal network requests, including to the EC2 Instance Metadata Service (IMDS). The vulnerability affects versions prior to 0.91.1 and has been fixed in version 0.91.1.