Threats Tagged 'ghsa-q567-cr4x-96w4'
View all threats tagged with 'ghsa-q567-cr4x-96w4'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-q567-cr4x-96w4'
Click on any threat for detailed analysis and mitigation recommendations
Trigger.dev contains a blind Server-Side Request Forgery (SSRF) vulnerability in its webhook alert channel implementation. Authenticated tenants can configure webhook URLs without validation, allowing the server to POST alert payloads to internal or metadata service IP addresses. This can lead to internal host scanning, state-changing POST requests to internal services, and potential access to IMDSv1 via redirects. The vulnerability affects versions prior to 4.5.2. A fix is available that includes validating webhook URLs against private, link-local, loopback, and metadata IP ranges and re-checking URLs at fetch time. Join the discussion | GCVE Database | 10/02/2026, 22:35:31 UTC Added: 10/03/2026, 17:21:57 UTC |
Showing 1 to 1 of 1 result