Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85650Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Medium 5.4

In plain English

A medium-severity server-side request forgery in trigger.dev from triggerdotdev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	trigger.dev	4.5.2	GHSA-xxv7-2vv3-h682

Affected products (as reported)

Vendor	Product	Versions
triggerdotdev	trigger.dev	0 – before 4.5.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Issue #4172 issue-tracking
https://github.com/triggerdotdev/trigger.dev product
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 patch
Trigger.dev v4.5.2 Release Notes release-notes
GitHub Security Advisory (GHSA-xxv7-2vv3-h682) vendor-advisory
VulnCheck Advisory: Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel third-party-advisory