CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6150 vulnerabilities reference this CWE, most recent first.
GHSA-XX3M-2JCF-FRFQ
Vulnerability from github – Published: 2023-11-03 03:30 – Updated: 2023-11-03 03:30IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247.
{
"affected": [],
"aliases": [
"CVE-2023-35896"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-03T03:15:07Z",
"severity": "MODERATE"
},
"details": "IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 259247.",
"id": "GHSA-xx3m-2jcf-frfq",
"modified": "2023-11-03T03:30:24Z",
"published": "2023-11-03T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35896"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259247"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7065203"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XX75-4FHF-JF2W
Vulnerability from github – Published: 2026-06-29 18:31 – Updated: 2026-06-29 18:31Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
{
"affected": [],
"aliases": [
"CVE-2026-57947"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-29T18:16:39Z",
"severity": "MODERATE"
},
"details": "Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.",
"id": "GHSA-xx75-4fhf-jf2w",
"modified": "2026-06-29T18:31:56Z",
"published": "2026-06-29T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57947"
},
{
"type": "WEB",
"url": "https://github.com/pinpoint-apm/pinpoint/issues/13857"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XXCQ-47CQ-JXJH
Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2025-09-22 21:30A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affects is-localhost-ip: 2.0.0.
{
"affected": [],
"aliases": [
"CVE-2025-9960"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T19:16:28Z",
"severity": "MODERATE"
},
"details": "A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF).\nThis issue affects is-localhost-ip: 2.0.0.",
"id": "GHSA-xxcq-47cq-jxjh",
"modified": "2025-09-22T21:30:29Z",
"published": "2025-09-22T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9960"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/registrada"
},
{
"type": "WEB",
"url": "https://github.com/tinovyatkin/is-localhost-ip"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XXCX-V673-PWPR
Vulnerability from github – Published: 2026-08-11 12:30 – Updated: 2026-09-09 18:31A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
{
"affected": [],
"aliases": [
"CVE-2026-13739"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T12:17:38Z",
"severity": "HIGH"
},
"details": "A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.",
"id": "GHSA-xxcx-v673-pwpr",
"modified": "2026-09-09T18:31:04Z",
"published": "2026-08-11T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13739"
},
{
"type": "WEB",
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-XXFV-G3W7-H5PG
Vulnerability from github – Published: 2026-08-27 00:30 – Updated: 2026-08-27 18:32Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
{
"affected": [],
"aliases": [
"CVE-2026-75332"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T23:17:18Z",
"severity": "CRITICAL"
},
"details": "Zyplayer-Doc \u003c=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().",
"id": "GHSA-xxfv-g3w7-h5pg",
"modified": "2026-08-27T18:32:06Z",
"published": "2026-08-27T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75332"
},
{
"type": "WEB",
"url": "https://github.com/fangtang7/CVE/blob/main/Zyplayer-Doc/Zyplayer-Doc.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXGW-78F3-7Q6J
Vulnerability from github – Published: 2026-09-11 00:31 – Updated: 2026-09-11 00:31IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-79723"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T22:17:00Z",
"severity": "MODERATE"
},
"details": "IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.",
"id": "GHSA-xxgw-78f3-7q6j",
"modified": "2026-09-11T00:31:14Z",
"published": "2026-09-11T00:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79723"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7286665"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXMG-WVH2-Q23Q
Vulnerability from github – Published: 2024-08-13 06:30 – Updated: 2024-08-13 06:30SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2024-41737"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T04:15:10Z",
"severity": "MODERATE"
},
"details": "SAP CRM ABAP (Insights\nManagement) allows an authenticated attacker to enumerate HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.",
"id": "GHSA-xxmg-wvh2-q23q",
"modified": "2024-08-13T06:30:47Z",
"published": "2024-08-13T06:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41737"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3487537"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXP4-MF4H-6CWM
Vulnerability from github – Published: 2023-06-22 21:30 – Updated: 2024-04-19 16:22An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.2.0"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.1.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.10.0"
},
{
"fixed": "3.11.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-35133"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-23T21:38:44Z",
"nvd_published_at": "2023-06-22T21:15:09Z",
"severity": "HIGH"
},
"details": "An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.",
"id": "GHSA-xxp4-mf4h-6cwm",
"modified": "2024-04-19T16:22:21Z",
"published": "2023-06-22T21:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35133"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2214373"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=447831"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-78215"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle vulnerable to Server Side Request Forgery"
}
GHSA-XXQH-2VWH-RX4F
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
{
"affected": [],
"aliases": [
"CVE-2020-21788"
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-24T15:15:00Z",
"severity": "MODERATE"
},
"details": "In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.",
"id": "GHSA-xxqh-2vwh-rx4f",
"modified": "2022-05-24T19:06:07Z",
"published": "2022-05-24T19:06:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-21788"
},
{
"type": "WEB",
"url": "https://gitee.com/ZhongBangKeJi/CRMEB/issues/I18MKC"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XXV7-2VV3-H682
Vulnerability from github – Published: 2026-10-02 19:31 – Updated: 2026-10-02 19:31Summary
A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a low-privilege authenticated user can make the server issue POST requests to internal-only services and cloud metadata endpoints (for example http://169.254.169.254/). No private-IP, scheme, or redirect filtering exists anywhere in the webapp.
Details
The delivery sink performs a raw fetch to the stored URL, apps/webapp/app/v3/services/alerts/deliverAlert.server.ts:949 (#deliverWebhook):
const response = await fetch(webhook.url, {
method: "POST",
headers: {
"content-type": "application/json",
"x-trigger-signature-hmacsha256": signatureHex,
},
body: rawPayload,
signal: AbortSignal.timeout(5000),
});
The same pattern is in apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts:245.
The URL is never validated. The stored shape is a bare string, apps/webapp/app/models/projectAlert.server.ts:6:
url: z.string(), // not even .url()
The public API that creates alert channels accepts it with no constraint, apps/webapp/app/presenters/v3/ApiAlertChannelPresenter.server.ts:35:
url: z.string().optional(),
and stores it (line 139-142). The dashboard create route applies only z.string().url(), which still accepts http://169.254.169.254/... and http://127.0.0.1/.... A repository-wide search for any SSRF guard (private-IP/link-local/loopback/metadata blocklist, DNS-rebinding re-check, request-filtering agent) in apps/webapp returns nothing, so no protection exists at any layer.
Creating the alert channel only requires organization membership (the API path resolves the project via findProjectByRef, which requires organization.members.some.userId); no admin role is needed.
PoC
As any member of an organization (using a personal access token or API key for a project they legitimately belong to):
POST /api/v1/projects/<projectRef>/alertChannels
Authorization: Bearer <token>
Content-Type: application/json
{
"name": "x",
"alertTypes": ["task_run_failure"],
"channel": "webhook",
"channelData": { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" }
}
Then cause a task run failure in the attacker's own (legitimately owned) environment. DeliverAlert/DeliverErrorGroupAlert fires and the webapp issues a POST to the internal URL, with a valid HMAC signature computed from the channel secret.
Live-validated: a local HTTP server was stood up on 127.0.0.1 to stand in for an internal/metadata endpoint, and the verbatim #deliverWebhook sink (HMAC-sign then raw fetch(webhook.url, POST, body) with no SSRF guard) was executed against it with webhook.url set to that internal address. Captured (what the internal server received):
[001 SSRF webhook alert] internal server received: {"url":"/latest/meta-data/","sigHeader":"a1d8dce41bda6c80df5a179cdc9f25320729b991ec3eb5f07df7ab9531149f65","body":"{\"alert\":\"task_run_failure\"}"}
SSRF: CONFIRMED (control-plane POSTed signed payload to internal/metadata URL, no guard)
The control plane delivered the signed payload to the internal URL. That a low-privilege org member can create the alert channel (findProjectByRef requires only org membership) is verified at source.
This is a blind/semi-blind SSRF: the response body is not returned to the attacker, but the request reaches the internal service (its POST body is delivered), and status, latency, and error differences are observable through the alert delivery logs/state.
Impact
A low-privilege authenticated organization member can use the trigger.dev control plane as an SSRF proxy into the internal network and the cloud metadata service. On cloud deployments this can reach the instance metadata endpoint (IMDS) and internal-only admin services. Because the request is server-originated and validly signed, it is indistinguishable from a legitimate trigger.dev callback to the receiving service.
Remediation
Validate the webhook URL on input (require https, reject hostnames that resolve to private, loopback, link-local, or metadata ranges) in ProjectAlertWebhookProperties and the API alert-channel schema, and enforce the same check at the fetch sinks in deliverAlert.server.ts and deliverErrorGroupAlert.server.ts, including re-checking after redirects (resolve the host and pin the connection, or use an SSRF-safe fetch agent).
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "trigger.dev"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-02T19:31:33Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev\u0027s control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a low-privilege authenticated user can make the server issue POST requests to internal-only services and cloud metadata endpoints (for example http://169.254.169.254/). No private-IP, scheme, or redirect filtering exists anywhere in the webapp.\n\n### Details\nThe delivery sink performs a raw fetch to the stored URL, apps/webapp/app/v3/services/alerts/deliverAlert.server.ts:949 (#deliverWebhook):\n```js\nconst response = await fetch(webhook.url, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-trigger-signature-hmacsha256\": signatureHex,\n },\n body: rawPayload,\n signal: AbortSignal.timeout(5000),\n});\n```\nThe same pattern is in apps/webapp/app/v3/services/alerts/deliverErrorGroupAlert.server.ts:245.\n\nThe URL is never validated. The stored shape is a bare string, apps/webapp/app/models/projectAlert.server.ts:6:\n```js\nurl: z.string(), // not even .url()\n```\nThe public API that creates alert channels accepts it with no constraint, apps/webapp/app/presenters/v3/ApiAlertChannelPresenter.server.ts:35:\n```js\nurl: z.string().optional(),\n```\nand stores it (line 139-142). The dashboard create route applies only `z.string().url()`, which still accepts http://169.254.169.254/... and http://127.0.0.1/.... A repository-wide search for any SSRF guard (private-IP/link-local/loopback/metadata blocklist, DNS-rebinding re-check, request-filtering agent) in apps/webapp returns nothing, so no protection exists at any layer.\n\nCreating the alert channel only requires organization membership (the API path resolves the project via findProjectByRef, which requires `organization.members.some.userId`); no admin role is needed.\n\n### PoC\nAs any member of an organization (using a personal access token or API key for a project they legitimately belong to):\n```http\nPOST /api/v1/projects/\u003cprojectRef\u003e/alertChannels\nAuthorization: Bearer \u003ctoken\u003e\nContent-Type: application/json\n\n{\n \"name\": \"x\",\n \"alertTypes\": [\"task_run_failure\"],\n \"channel\": \"webhook\",\n \"channelData\": { \"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\" }\n}\n```\nThen cause a task run failure in the attacker\u0027s own (legitimately owned) environment. DeliverAlert/DeliverErrorGroupAlert fires and the webapp issues a POST to the internal URL, with a valid HMAC signature computed from the channel secret.\n\nLive-validated: a local HTTP server was stood up on 127.0.0.1 to stand in for an internal/metadata endpoint, and the verbatim #deliverWebhook sink (HMAC-sign then raw fetch(webhook.url, POST, body) with no SSRF guard) was executed against it with webhook.url set to that internal address. Captured (what the internal server received):\n```\n[001 SSRF webhook alert] internal server received: {\"url\":\"/latest/meta-data/\",\"sigHeader\":\"a1d8dce41bda6c80df5a179cdc9f25320729b991ec3eb5f07df7ab9531149f65\",\"body\":\"{\\\"alert\\\":\\\"task_run_failure\\\"}\"}\nSSRF: CONFIRMED (control-plane POSTed signed payload to internal/metadata URL, no guard)\n```\nThe control plane delivered the signed payload to the internal URL. That a low-privilege org member can create the alert channel (findProjectByRef requires only org membership) is verified at source.\n\nThis is a blind/semi-blind SSRF: the response body is not returned to the attacker, but the request reaches the internal service (its POST body is delivered), and status, latency, and error differences are observable through the alert delivery logs/state.\n\n### Impact\nA low-privilege authenticated organization member can use the trigger.dev control plane as an SSRF proxy into the internal network and the cloud metadata service. On cloud deployments this can reach the instance metadata endpoint (IMDS) and internal-only admin services. Because the request is server-originated and validly signed, it is indistinguishable from a legitimate trigger.dev callback to the receiving service.\n\n### Remediation\nValidate the webhook URL on input (require https, reject hostnames that resolve to private, loopback, link-local, or metadata ranges) in ProjectAlertWebhookProperties and the API alert-channel schema, and enforce the same check at the fetch sinks in deliverAlert.server.ts and deliverErrorGroupAlert.server.ts, including re-checking after redirects (resolve the host and pin the connection, or use an SSRF-safe fetch agent).",
"id": "GHSA-xxv7-2vv3-h682",
"modified": "2026-10-02T19:31:33Z",
"published": "2026-10-02T19:31:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682"
},
{
"type": "WEB",
"url": "https://github.com/triggerdotdev/trigger.dev/pull/4199"
},
{
"type": "PACKAGE",
"url": "https://github.com/triggerdotdev/trigger.dev"
},
{
"type": "WEB",
"url": "https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.