Login Request a demo
Medium severity · published Oct 21, 2026
CVE-2026-114080
Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
5.0
CVSS
0.3%
EPSS
No
On KEV
Description
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata addresses, then trigger alerts to probe internal service reachability and send signed POST requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.5.2 · source: vendor
Affected product
TR
trigger.dev
triggerdotdev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114080
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-2wgf-7gx2-hcpw
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url-2
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint