Live › vulnerability › CVE-2026-114074
Go to dashboardTrigger.dev before 4.5.10 fails to block the 198.18.0.0/15 benchmarking range in its webhook SSRF filter. An authenticated project member can point an alert-channel webhook at internal services in that range and send blind probes and limited state-changing POST requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trigger.dev deployments running a version before 4.5.10 where project members can configure alert-channel webhooks and internal services sit on routed 198.18.0.0/15 addresses. Teams using Trigger.dev Cloud or deployments already on 4.5.10 or later can skip it.
No product ranges from the sources yet.
4.5.104.5.10 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-114074")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.