What’s Vulnerable › Vulnerabilities

CVE-2026-114080: Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-21
• Weakness: CWE-918

Description

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata addresses, then trigger alerts to probe internal service reachability and send signed POST requests.

Affected products

• triggerdotdev trigger.dev: before 4.5.2 — fixed in 4.5.2

How to fix

Upgrade to a fixed version: triggerdotdev trigger.dev 4.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-2wgf-7gx2-hcpw
• https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url-2

Get alerted when CVE-2026-114080 or the next vulnerability affects your stack