CVE-2026-114074 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, security teams, and administrators should assess exposure and prioritize remediation. This includes reviewing the vulnerability's potential impact on internally routed services and taking steps to verify exposure and restrict access to sensitive services.

Why it matters

Defenders should prioritize verifying exposure and assessing internal service accessibility due to the server-side request forgery vulnerability in Trigger.dev before 4.5.10.

• Authenticated project members can bypass webhook SSRF protections
• Blind internal probing and limited state-changing POST requests are possible
• Internal service accessibility may be compromised
• Verification of exposure and remediation are necessary

Technical summary

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.

Defensive priority

Defenders should prioritize verifying exposure and assessing internal service accessibility.

Recommended defensive actions

• Verify Trigger.dev version and upgrade to 4.5.10 or later if necessary
• Assess internal service accessibility and restrict access to sensitive services
• Monitor for suspicious activity and implement additional security measures as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references. The vulnerability has been identified in Trigger.dev before 4.5.10, and defenders should verify exposure and assess internal service accessibility. The source item and CVE record provide evidence of the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.