Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.
CVE-2026-114076
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-114076
trigger.dev
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "triggerdotdev",
"product": "trigger.dev",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.5.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.2",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/trigger.dev",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-114076
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #44961 · Revision 1
- Added to Heist Feed
- Publisher date