CVE-2026-85650: Trigger.dev SSRF Vulnerability

CVE-2026-85650 Overview

CVE-2026-85650 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Trigger.dev versions prior to 4.5.2. The flaw exists in the webhook alert channel delivery logic, which fetches user-supplied URLs without validation or SSRF protection. Authenticated users with organization membership can create alert channels pointing to internal services, loopback interfaces, or cloud metadata endpoints. The Trigger.dev server then issues POST requests to those restricted resources on the attacker's behalf. This can expose internal-only APIs, cloud instance metadata, and other services that are otherwise unreachable from the public network.

Critical Impact
Authenticated organization members can pivot the Trigger.dev server into internal networks and reach cloud metadata endpoints via crafted webhook alert channel URLs.

Affected Products

Trigger.dev versions prior to 4.5.2
Self-hosted Trigger.dev deployments exposing the alert channel feature
Managed Trigger.dev environments running vulnerable builds

Discovery Timeline

2026-09-04 - CVE-2026-85650 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85650

Vulnerability Analysis

Trigger.dev supports webhook alert channels, allowing organization members to register a URL that receives POST notifications when specific events occur. Before version 4.5.2, the server accepted arbitrary URLs and issued outbound requests without performing hostname, scheme, or IP address validation.

An authenticated user with organization membership can register an alert channel URL pointing to http://127.0.0.1, http://169.254.169.254/latest/meta-data/, or internal service hostnames. When the alert triggers, the Trigger.dev backend fetches the URL server-side. This gives the attacker a request primitive originating from the trusted server context.

Because the request is a POST issued by the server, responses that are not returned to the attacker can still cause side effects on internal APIs, and metadata endpoints reachable via GET-equivalent redirection or specific service configurations may leak sensitive material.

Root Cause

The root cause is missing SSRF defense on the webhook delivery path. There is no allow-list of external hosts, no denial of private or link-local address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16), and no scheme restriction. URLs are consumed directly by the HTTP client that delivers alert payloads.

Attack Vector

Exploitation requires an authenticated account with organization membership. The attacker creates an alert channel of type webhook and supplies a URL targeting an internal resource, then triggers the alert condition to force the server-side request.

typescript

// Sanitized illustration of the fix pattern introduced in v4.5.2
// Source: https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
import { RadarPulseIcon } from "~/assets/icons/RadarPulseIcon";
import { StarIcon } from "~/assets/icons/StarIcon";
import { useShortcutKeys } from "~/hooks/useShortcutKeys";
import { sanitizeHttpUrl } from "~/utils/sanitizeUrl";
import { useCurrentPlan } from "~/routes/_app.orgs.$organizationSlug/route";
import { useRecentChangelogs } from "~/routes/resources.platform-changelogs";
import { cn } from "~/utils/cn";

The patch introduces a sanitizeHttpUrl utility that validates URLs before they are consumed by outbound HTTP flows. See the GitHub commit for the full change set.

Detection Methods for CVE-2026-85650

Indicators of Compromise

Alert channel records containing URLs with private, loopback, or link-local IP addresses such as 127.0.0.1, 169.254.169.254, 10.x.x.x, or 192.168.x.x.
Outbound webhook delivery attempts from the Trigger.dev server toward internal hostnames or non-HTTPS schemes.
Repeated alert creation and deletion by the same organization member within short intervals, suggesting URL fuzzing.

Detection Strategies

Query the Trigger.dev database for alert channel entries where the destination host resolves to internal or reserved IP ranges.
Inspect application logs for HTTP client errors originating from the webhook delivery service targeting non-routable addresses.
Correlate alert channel creation events with subsequent outbound connection attempts to cloud metadata IPs.

Monitoring Recommendations

Enable egress logging on the Trigger.dev host and alert on traffic destined for 169.254.169.254 or RFC1918 ranges.
Audit organization member activity for creation of webhook alert channels with unusual URL patterns.
Track version banners across Trigger.dev deployments and flag any instance running a build earlier than 4.5.2.

How to Mitigate CVE-2026-85650

Immediate Actions Required

Upgrade all Trigger.dev deployments to version 4.5.2 or later using the v4.5.2 release notes.
Review existing alert channels and remove any with URLs referencing internal hosts or cloud metadata endpoints.
Rotate any cloud instance credentials that may have been exposed through metadata requests originating from the Trigger.dev server.

Patch Information

The fix is delivered in Trigger.dev 4.5.2. It adds a sanitizeHttpUrl helper that validates outbound webhook URLs, blocking non-HTTP(S) schemes and private address ranges. Full details are available in the GitHub Security Advisory GHSA-xxv7-2vv3-h682 and the corresponding VulnCheck advisory.

Workarounds

Place the Trigger.dev server behind an egress proxy that denies traffic to RFC1918, loopback, and link-local addresses.
Restrict organization membership to trusted users until the upgrade is deployed.
Deploy network policies that block outbound access to 169.254.169.254 from the Trigger.dev workload where instance metadata is not required.

bash

# Example iptables rules to block SSRF-relevant destinations from the Trigger.dev host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT