CVE-2026-85650
Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 4, 2026
- Updated
- Sep 4, 2026
- Reserved
- Sep 4, 2026
Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
trigger.devtriggerdotdev |
|
References
- GitHub Issue #4172issue-tracking
- https://github.com/triggerdotdev/trigger.devproduct
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254patch
- Trigger.dev v4.5.2 Release Notesrelease-notes
- GitHub Security Advisory (GHSA-xxv7-2vv3-h682)vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channelthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.