Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-114076 · Microsoft / collected KEV context

EUVD-2026-107027

GHSA-3mx6-67xp-8wvp

GHSA-q567-cr4x-96w4

cve-program · CVE-2026-114076

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
• https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url

euvd · EUVD-2026-107027

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
• https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url

nvd · CVE-2026-114076

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
• https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-blind-ssrf-via-alert-channel-webhook-url

osv · GHSA-q567-cr4x-96w4

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-q567-cr4x-96w4
• https://github.com/triggerdotdev/trigger.dev/pull/4199
• https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
• https://github.com/triggerdotdev/trigger.dev
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2

• Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attack… · Advisory content revised · 29 Oct 2026