Live › vulnerability › CVE-2026-114076
Go to dashboardTrigger.dev before 4.5.2 does not validate the webhook alert channel URL, so an authenticated tenant can make the webapp server send POST requests to internal hosts. An attacker can use this to probe internal services, send state-changing requests, or reach cloud instance metadata via redirects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trigger.dev instances running a version before 4.5.2 where authenticated tenants can configure webhook alert channels. The webapp server must have network access to internal services or metadata endpoints for the impact to be meaningful. Teams using Trigger.dev Cloud or instances already on 4.5.2 or later can skip it.
No product ranges from the sources yet.
version in the package.json of the deployed app, and confirm whether it is below 4.5.2.4.5.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.
This page as .md · .json · in your agent: get_signal("CVE-2026-114076")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.