medium5.4
CVE-2026-114074
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by …
Impact
Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.
Affected products
| Product | Affected versions |
|---|---|
| Trigger.Dev | before 4.5.10 |
Versions were read from the advisory text. No structured product data has been published for this record yet.