CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114076?
CVE-2026-114076 is a medium-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.
Official description
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.
Weakness: CWE-918
Which versions are affected by CVE-2026-114076?
2 open source packages ship an affected version, including trigger.dev.
| Package | Affected | Fixed in |
|---|---|---|
trigger.dev npm | All versions | 4.5.2 |
trigger.dev npm | All versions | 4.5.2 |
How do I fix CVE-2026-114076?
Upgrade trigger.dev to 4.5.2 or later.
Is CVE-2026-114076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114076 exists.
Sources
Also known as GHSA-3mx6-67xp-8wvp, GHSA-q567-cr4x-96w4, MINI-jhh5-jghj-5qjj.