CVE-2026-85650: trigger.dev Server-Side Request Forgery via Unvalidated Webhook Alert-Channel URL
Summary
CVE-2026-85650: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL. Affects trigger.dev versions < 4.5.2. Fixed in 4.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
trigger.dev is a platform that enables developers to automate workflows and manage alerts through webhooks. It allows users to create alert channels for various events, facilitating real-time notifications and integrations. However, the platform has a critical vulnerability that allows low-privilege authenticated users to exploit unvalidated webhook URLs, potentially leading to unauthorized access to internal services.
Vulnerability Detail
The vulnerability arises from the lack of validation for webhook alert-channel URLs created by project members. An authenticated user can create a webhook that points to an internal address, allowing the trigger.dev control plane to send alerts to that URL without any SSRF protection. This means that the user can make the server issue POST requests to internal services or cloud metadata endpoints, such as http://169.254.169.254/. The absence of any filtering for private IPs, schemes, or redirects makes this a significant security risk, as it allows unauthorized access to sensitive internal resources.
How To Fix
Latest published version: 4.7.7 as of 22 Oct 2026
npm install trigger.dev@4.7.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.2
This is the first release that contains the fix.
npm install trigger.dev@4.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a manual validation process for webhook URLs before they are stored. Ensure that any URLs do not resolve to private, loopback, link-local, or metadata ranges. This can be done by checking the URL against a list of disallowed patterns before accepting it.
Conclusion
The CVE-2026-85650 vulnerability in trigger.dev poses a significant risk due to the lack of validation for webhook URLs, allowing low-privilege users to exploit the system. It is crucial to update to the patched version 4.5.2 and implement additional validation measures to secure the application.
See every vulnerability recorded for trigger.dev →
FAQ
The vulnerability is a server-side request forgery (SSRF) that allows low-privilege users to send requests to internal services by creating unvalidated webhook URLs.
Any organization using trigger.dev where members can create webhook alert channels is potentially affected, especially if those members have low privileges.
The impact includes unauthorized access to internal services and cloud metadata, which could lead to data leaks or further exploitation of internal systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for trigger.dev.
