{"vulnerability": "CVE-2026-85650", "sightings": [{"uuid": "43bdac4d-5f0b-4a2b-a696-2e8554814528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85650", "type": "seen", "source": "https://gist.github.com/alon710/4a847ee61554d83a142783612cd3e96f", "content": "# GHSA-XXV7-2VV3-H682: CVE-2026-85650: Server-Side Request Forgery in Trigger.dev Webhook Alert Channel Delivery\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/GHSA-XXV7-2VV3-H682\n\n## Summary\nA critical Server-Side Request Forgery (SSRF) vulnerability in Trigger.dev prior to version 4.5.2 allows authenticated organization members to configure webhook alert channels with unvalidated target URLs. This can lead to internal network scanning and cloud metadata extraction.\n\n## TL;DR\nUnvalidated webhook URLs in Trigger.dev allow authenticated users to perform server-side requests against internal services and cloud metadata endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (Server-Side Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Base Score**: 7.7 (High)\n- **EPSS Score**: 0.00348\n- **Exploit Status**: PoC (Proof of Concept Available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Trigger.dev Control Plane Webapp\n- Trigger.dev Self-Hosted Web Application\n- **trigger.dev**: < 4.5.2 (Fixed in: `4.5.2`)\n\n## Mitigation\n\n- Implement multi-layered input schema validation to prevent local IP entry.\n- Execute connection-bound socket DNS validation to prevent DNS rebinding.\n- Deploy step-by-step redirect validation limited to 5 hops.\n- Enforce network egress filtering to segment internal services.\n\n**Remediation Steps:**\n1. Upgrade Trigger.dev self-hosted instances to version 4.5.2 or above.\n2. Verify active database entries in 'ProjectAlert' for non-public IP configurations.\n3. Configure firewalls to block outbound traffic from the Trigger.dev control plane to the private network range.\n4. Enforce IMDSv2 with a hop limit of 1 in cloud hosting environments.\n\n## References\n\n- [GitHub Advisory GHSA-xxv7-2vv3-h682](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xxv7-2vv3-h682)\n- [Official Patch Commit](https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254)\n- [Trigger.dev Release v4.5.2](https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2)\n- [Authoritative CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-85650)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XXV7-2VV3-H682) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-02T20:30:31.000000Z"}]}