PT-2026-85551

CVE-2026-85650

Published

2026-09-04

Updated

2026-10-02

Description by

CVSS 3.1

7.7

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2

Description Authenticated users with organization membership can exploit a server-side request forgery (SSRF) issue. This occurs because webhook alert channel delivery URLs are fetched without proper validation or protection. An attacker can create alert channels with URLs targeting internal services and metadata endpoints, causing the server to issue POST requests to restricted resources.

Recommendations Update to version 4.5.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers

CVE-2026-85650