CVE-2026-114076

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2

Description Authenticated tenants can exploit a blind server-side request forgery (SSRF) by configuring an unvalidated webhook alert channel URL. The webapp server fails to validate the url variable against a host allowlist or private-IP blocklist, allowing the server to send POST requests to internal hosts, cloud metadata addresses, or reach IMDSv1 via redirects. This occurs when the alertsWorker uses the DeliverAlertService to send HMAC-signed alert payloads via the fetch() function. The issue is rooted in the ApiAlertChannelPresenter.server.ts file where the URL is accepted without syntax or host validation, and is subsequently processed in deliverAlert.server.ts and deliverErrorGroupAlert.server.ts.

Recommendations Update Trigger.dev to version 4.5.2 or later. As a temporary workaround, restrict the use of the webhook alert channel feature until the update is applied.