HighFix available
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Type: advisorySource: OSV
Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is store…
Products: trigger.devCVEs: CVE-2026-85650