CVEvulnerability
CVE-2026-85650
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-04
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-918
Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/triggerdotdev/trigger.dev github.com
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 github.com
- https://github.com/triggerdotdev/trigger.dev/issues/4172 github.com
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2 github.com
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682 github.com
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-request-forgery-via-webhook-alert-channel www.vulncheck.com
- https://github.com/triggerdotdev/trigger.dev/issues/4172 github.com