Vulnerability Description
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fhh4-xvj5-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.10-webhook-ssrf-prot
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fhh4-xvj5-
FAQ
What is CVE-2026-114074?
CVE-2026-114074 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 be...
How severe is CVE-2026-114074?
CVE-2026-114074 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114074?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.