---
id: CVE-2026-85650
title: >-
  Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability
  in webhook alert channel delivery URLs that are fetched without validation or
  SSRF protection
summary: >-
  Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability
  in webhook alert channel delivery URLs that are fetched without validation or
  SSRF protection. Authenticated users with organization membership can create
  aler…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2026-09-04'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:43.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85650'
references:
  - url: 'https://github.com/triggerdotdev/trigger.dev'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
    label: disclosure@vulncheck.com
  - url: 'https://github.com/triggerdotdev/trigger.dev/issues/4172'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-request-forgery-via-webhook-alert-channel
    label: disclosure@vulncheck.com
  - url: 'https://github.com/triggerdotdev/trigger.dev/issues/4172'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00313
epssPercentile: 0.24455
ingestedAt: '2026-09-23T17:28:14.824Z'
---

## Overview

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.