Server-Side Request Forgery in Trigger.dev Webhook Alert Channels

CVE-2026-85650

What is CVE-2026-85650?

Trigger.dev, prior to version 4.5.2, is susceptible to a server-side request forgery (SSRF) vulnerability through its webhook alert channel delivery URLs. This issue arises because the URLs are fetched without any validation or protection against SSRF attacks. Authenticated users with membership in an organization can exploit this to create alert channels that target internal services and sensitive metadata endpoints. As a result, the server may issue unauthorized POST requests to restricted resources, potentially exposing internal systems to malicious activity.

References