---
id: CVE-2026-114076
title: Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
summary: >-
  Trigger.dev before 4.5.2 contains a blind server-side request forgery
  vulnerability that allows authenticated tenants to make the webapp server send
  POST requests to internal hosts by setting an unvalidated webhook alert
  channel URL. Att…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.2
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:45.853Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114076'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
    label: GitHub Security Advisory (GHSA-q567-cr4x-96w4)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.2 Blind SSRF via Alert Channel
      Webhook URL
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.024Z'
---

## Overview

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.

## Affected

- `trigger.dev < 4.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.