Trigger.dev SSRF Bypass via 198.18.0.0/15 Range

Executive Summary

CVE-2026-114074 is a Server-Side Request Forgery (SSRF) vulnerability in Trigger.dev versions before 4.5.10. It allows authenticated project members to bypass webhook SSRF protections by targeting the 198.18.0.0/15 IP range, which is excluded from standard unsafe IP checks. This enables sending blind internal probes and limited state-changing POST requests to internally routed services within that range.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your trigger.dev instance is running a version before 4.5.10. Inspect webhook configurations for any alerts pointing to the 198.18.0.0/15 IP range. Monitor network traffic for internal POST requests to this range from the trigger.dev application.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access could probe internal services, perform timing or status checks, and send limited state-changing requests to internal HTTP services. However, response bodies are not returned, limiting data exfiltration. The impact is primarily internal network reconnaissance and potential limited state changes.

Useful 0 Not Useful 0

Compliance Impact

The SSRF vulnerability in Trigger.dev (CVE-2026-114074) could potentially impact compliance with GDPR and HIPAA by enabling unauthorized internal network probing and limited state-changing requests. This may expose sensitive data or systems to attackers, violating data protection requirements for confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade trigger.dev to version 4.5.10 or later. Review and remove any webhook configurations targeting the 198.18.0.0/15 range. Implement network-level controls to block outbound traffic to this IP range from the trigger.dev server.

Useful 0 Not Useful 0