Live › vulnerability › CVE-2026-114080
Go to dashboardTrigger.dev before 4.5.2 does not validate alert-channel webhook URLs, so an authenticated project member can point an alert at loopback, internal, or cloud metadata addresses. The server then sends requests to those targets, letting an attacker probe internal services and send signed POST requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trigger.dev deployments running a version before 4.5.2 that have alert channels available to project members. The risk is highest where the server can reach internal networks or cloud metadata endpoints. Instances on a fixed version, or with no untrusted users in projects, are less exposed.
No product ranges from the sources yet.
4.5.2; anything lower is affected4.5.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata addresses, then trigger alerts to probe internal service reachability and send signed POST requests.
This page as .md · .json · in your agent: get_signal("CVE-2026-114080")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.