CVE-2026-85650

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2

Description Authenticated users with organization membership can exploit a server-side request forgery (SSRF) issue. This occurs because webhook alert channel delivery URLs are fetched without proper validation or protection. An attacker can create alert channels with URLs targeting internal services and metadata endpoints, causing the server to issue POST requests to restricted resources.

Recommendations Update to version 4.5.2 or later.