CVE-2026-114080: Trigger.dev server-side request forgery in alert-channel webhook URL

CVE-2026-114080 · Severity: medium · CVSS 5 · Published 2026-10-21

Trigger.dev is a workflow automation platform that sends alert notifications via webhook URLs configured by project members. A vulnerability in versions before 4.5.2 allows authenticated users to set arbitrary webhook URLs, enabling the server to send requests to internal networks, loopback addresses, or cloud metadata endpoints without validation. This could expose internal service reachability information and allow attackers to send signed POST requests to internal systems.

Technologies: Trigger.dev. Vendors: Trigger.dev.

Quick answers

Is CVE-2026-114080 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114080 being exploited in the wild.
How severe is CVE-2026-114080?
Medium severity, with a CVSS score of 5, published 21 October 2026.
Which products and versions are affected?
Trigger.dev before 4.5.2.
Is there a fix for CVE-2026-114080?
Yes: fixed in 4.5.2 and later. Until then: Enforce server-side outbound validation in the alert dispatcher before sending any request: block requests to loopback addresses (127.0.0.0/8, ::1), private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses, and cloud metadata endpoints after DNS resolution, and apply the same checks to redirect destinations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114080 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-114080?
Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.5.2 and later

Enforce server-side outbound validation in the alert dispatcher before sending any request: block requests to loopback addresses (127.0.0.0/8, ::1), private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses, and cloud metadata endpoints after DNS resolution, and apply the same checks to redirect destinations.

Technical details

This is a blind server-side request forgery (CWE-918) in the alert dispatcher that fails to validate webhook URLs before dispatching outbound requests. An authenticated project member can create an alert channel with an unvalidated URL via POST /api/v1/projects/:projectRef/alertChannels, then trigger alerts to force the server to send HTTP POST requests to attacker-controlled destinations including loopback (127.0.0.1), private IP ranges, and metadata endpoints. The vulnerability requires authentication but no special privileges, and the attacker cannot read response bodies—only determine reachability via response status and timing.

Affected products

  • Trigger.dev Trigger.dev before 4.5.2

Timeline

  • 2026-07-09: advisory
  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.