CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
Authenticated users can exploit SSRF in webhook alert channels to access internal services and metadata endpoints via the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85650?
CVE-2026-85650 is a medium-severity server-side request forgery vulnerability in triggerdotdev trigger.dev, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Weakness: CWE-918
Which versions are affected by CVE-2026-85650?
2 open source packages ship an affected version, including trigger.dev.
| Package | Affected | Fixed in |
|---|---|---|
trigger.dev npm | All versions | 4.5.2 |
trigger.dev npm | All versions | 4.5.2 |
How do I fix CVE-2026-85650?
Upgrade trigger.dev to 4.5.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-85650 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85650 exists.
Sources
Also known as GHSA-2463-rh88-r3gg, GHSA-xxv7-2vv3-h682, MINI-wcjg-7chg-mwm9.