---
id: CVE-2026-114074
title: >-
  Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15
  Range
summary: >-
  Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability
  that allows authenticated project members to bypass webhook SSRF protections
  by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can
  confi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.10
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:44.452Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114074'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fhh4-xvj5-m7pq
    label: GitHub Security Advisory (GHSA-fhh4-xvj5-m7pq)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.10-webhook-ssrf-protection-bypass-via-198.18.0.0-15-range
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.10 Webhook SSRF Protection
      Bypass via 198.18.0.0/15 Range
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.025Z'
---

## Overview

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.

## Affected

- `trigger.dev < 4.5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.