Description

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T15:17:43.190Z",
  "pubdate": "2026-09-04T15:17:43.190Z",
  "executiveSummary": "Trigger.dev versions prior to 4.5.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the webhook alert channel delivery mechanism.\nThe vulnerability allows an authenticated user with organization membership to bypass internal network security controls by forcing the application server to initiate unauthorized POST requests to arbitrary URLs.\nThis flaw stems from a lack of input validation and the absence of SSRF protection mechanisms when processing webhook destination URLs.\nAn attacker can exploit this to interact with internal infrastructure, query private cloud metadata services (e.g., IMDS), or reach internal-only microservices that are not exposed to the public internet.\nThe risk is significant as it facilitates internal network reconnaissance, potential data exfiltration from private endpoints, and interaction with internal APIs, bypassing perimeter defenses.\nThe exploitation requirement is limited to possessing authenticated organization membership, which provides sufficient access to configure alert channels and trigger the malicious request flow.",
  "technicalDetails": "The vulnerability is located within the webhook alert channel delivery system, specifically in the component responsible for dispatching notifications to user-defined endpoints. The application fails to implement adequate URL validation or sanitization, allowing the inclusion of internal network addresses and restricted service endpoints as webhook targets.\nRoot cause analysis indicates that the application performs an unvalidated server-side request initiation when an alert is triggered. When a user defines an alert channel URL, the system performs a fetch operation—likely using a standard HTTP client—without inspecting the target host or enforcing blocklists against private IP ranges (e.g., 127.0.0.1, 169.254.169.254, 10.0.0.0/8).\nThe attack flow proceeds as follows: First, an authenticated attacker with membership in an organization navigates to the alert channel configuration interface. Second, the attacker inputs a malicious URL pointing to an internal resource, such as an internal management interface or a cloud provider's metadata service. Third, upon an event triggering the alert, the application backend executes an HTTP POST request to the specified target. Fourth, the server acts as a proxy, sending the POST request from the trusted server environment toward the internal target.\nThe exploitation payload allows the attacker to reach restricted resources that are typically shielded by network firewalls. By manipulating the POST body and headers of the webhook request, the attacker may perform unauthorized actions against internal services, such as modifying configurations or triggering state changes, depending on the target service's design.\nImpact includes but is not limited to: probing the server's network topology, bypassing authentication for internal services that rely on network-level trust, and potential retrieval of sensitive infrastructure information if querying metadata endpoints. The absence of a request validation layer prior to dispatch ensures that these requests are executed with the full privilege and network access of the Trigger.dev backend service, significantly magnifying the potential for post-exploitation lateral movement within the hosting environment."
}