CVE-2026-114076
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
61/100
Published: 2026-10-21
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
AT:
None
VC:
Low
VI:
Low
VA:
None
Description
Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| triggerdotdev | trigger.dev | 0 < 4.5.2 |