CVE-2026-114080Medium· 5.0▾ SunlitTrigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata addresses, then trigger alerts to probe internal service reachability and send signed POST requests.
trigger.dev < 4.5.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114074Medium· 5.4Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range
CVE-2026-114076Medium· 5.4Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
GHSA-q567-cr4x-96w4Medium· 5.4Trigger.dev: Blind SSRF via alert-channel webhook
GHSA-xxv7-2vv3-h682High· 7.7Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
CVE-2026-114065Medium· 6.5Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints