CVE-2026-114076: Server-Side Request Forgery (SSRF) in triggerdotdev trigger.dev
Description
Trigger.dev versions before 4.5.2 contain a blind server-side request forgery (SSRF) vulnerability. Authenticated tenants can exploit this by setting an unvalidated webhook alert channel URL, causing the server to send POST requests to internal hosts. This can be used to interact with internal services or cloud metadata endpoints, potentially triggering state-changing requests or accessing IMDSv1 via redirects.
CVSS v4.0
Score 5.3medium
Affected software
triggerdotdev
trigger.dev
pkg:github/triggerdotdev/trigger.devRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-114076 describes a blind SSRF vulnerability in trigger.dev prior to version 4.5.2. The flaw allows authenticated users to configure webhook alert channel URLs without proper validation, enabling the server to send arbitrary POST requests to internal network hosts or cloud metadata services. This can be leveraged to scan internal hosts, perform state-changing operations, or access cloud instance metadata services such as IMDSv1 through redirects.
Potential Impact
An authenticated tenant can exploit this vulnerability to make the trigger.dev server send POST requests to internal or cloud metadata endpoints. This can lead to unauthorized internal network scanning, manipulation of internal services, or exposure of sensitive cloud metadata information. The vulnerability does not require user interaction and has a medium severity with a CVSS 4.0 score of 5.3.
Mitigation Recommendations
A fix is available in trigger.dev version 4.5.2. Users should upgrade to version 4.5.2 or later to remediate this SSRF vulnerability. No additional mitigation guidance is provided, and patching is the recommended action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:44:47.242Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c042cdf04f6568caa37
Added to database: 10/21/2026, 00:49:08 UTC
Last enriched: 10/21/2026, 01:19:09 UTC
Last updated: 10/21/2026, 02:08:18 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.