Medium severity5.4NVD Advisory· Published Sep 4, 2026· Updated Sep 4, 2026
CVE-2026-85650
CVE-2026-85650
Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Affected products
1- Range: <4.5.2
Patches
Vulnerability mechanics
References
5- github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254nvd
- github.com/triggerdotdev/trigger.dev/issues/4172nvd
- github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2nvd
- github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682nvd
- www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-request-forgery-via-webhook-alert-channelnvd
News mentions
0No linked articles in our index yet.