Vulnerability Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b
- https://github.com/triggerdotdev/trigger.dev/issues/4172
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-server-side-reques
- https://github.com/triggerdotdev/trigger.dev/issues/4172
FAQ
What is CVE-2026-85650?
CVE-2026-85650 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with or...
How severe is CVE-2026-85650?
CVE-2026-85650 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85650?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.