CVE-2026-114074

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.10

Description Authenticated project members can bypass server-side request forgery (SSRF) protections by targeting the non-global 198.18.0.0/15 benchmarking range. This occurs because the UnsafeIPv4 check omits this specific range, allowing attackers to configure alert-channel webhooks that point to internally routed services. This can be used to perform blind internal probing and limited state-changing POST requests.

Recommendations Update to version 4.5.10 or later.