Login Request a demo
Medium severity · published Sep 4, 2026
CVE-2026-85650
Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.5.2 · source: vendor
Affected product
TR
trigger.dev
triggerdotdev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85650
github.com
https://github.com/triggerdotdev/trigger.dev
github.com
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
github.com
https://github.com/triggerdotdev/trigger.dev/issues/4172
github.com
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-request-forgery-via-webhook-alert-channel
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint