Security Advisory

CVE-2026-85650

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-04 14:32:16

Last updated 2026-09-04 15:33:11

Assigner VulnCheck

CVSS score 5.4

State PUBLISHED

Description

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

← Browse all CVEs View on cve.org ↗