CVE-2026-114074: Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Q: Who can exploit this issue?

An authenticated Trigger.dev project member can exploit it. Exploitation requires the attacker to be able to configure an alert-channel webhook.

Q: What systems are exposed through the bypass?

The bypass targets internally routed services whose addresses fall within the non-global 198.18.0.0/15 benchmarking range. It can be used for blind internal probing and limited state-changing POST requests.

Q: Which versions need remediation?

Trigger.dev versions before 4.5.10 are affected. Upgrading to 4.5.10 or later addresses the described SSRF protection bypass.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev to a version that resolves this vulnerability.
Fixed in 4.5.10

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Trigger.dev project member can exploit it. Exploitation requires the attacker to be able to configure an alert-channel webhook.

What systems are exposed through the bypass?

The bypass targets internally routed services whose addresses fall within the non-global 198.18.0.0/15 benchmarking range. It can be used for blind internal probing and limited state-changing POST requests.

Which versions need remediation?

Trigger.dev versions before 4.5.10 are affected. Upgrading to 4.5.10 or later addresses the described SSRF protection bypass.

CVE-2026-114074: Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What systems are exposed through the bypass?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What systems are exposed through the bypass?

Which versions need remediation?