CVE-2026-85650
Received Received - Intake

Server-Side Request Forgery in Trigger.dev Alert Channels

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85650
EUVD
EUVD-2026-71114

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trigger.dev trigger.dev to 4.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Trigger.dev before 4.5.2 has a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs. These URLs are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, causing the server to issue POST requests to restricted resources.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected POST requests from Trigger.dev servers to internal endpoints. Check webhook alert channel configurations for URLs pointing to internal services or metadata endpoints. Review server logs for SSRF attempts or unauthorized access patterns.

Impact Analysis

An attacker with organization access could exploit this to make the server send requests to internal systems or sensitive endpoints. This may lead to unauthorized data access, internal service probing, or potential data exfiltration through crafted webhook URLs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches if internal systems or data are accessed without authorization.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.2 or later. Disable or restrict webhook alert channels with internal or sensitive URLs. Implement network-level controls to block outbound requests from Trigger.dev to internal IP ranges. Review and audit existing alert channel configurations for suspicious URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart