CVE-2026-114076 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, particularly those using the alert channel webhook feature, should assess their exposure to this vulnerability and apply the provided patch or mitigation measures.

Why it matters

CVE-2026-114076 describes a blind SSRF vulnerability in Trigger.dev that allows an authenticated tenant to point a webhook at internal infrastructure or specific IP addresses, causing the server to fetch it. Defenders should verify exposure, check for affected versions, and apply patches or mitigation measures.

• Verify exposure of internal infrastructure to SSRF
• Check and patch affected versions to prevent exploitation
• Monitor for suspicious activity related to the alert channel webhook feature

Technical summary

The vulnerability is caused by the lack of proper validation for user-supplied URLs in the alert channel webhook feature of Trigger.dev. An authenticated tenant can exploit this by pointing the webhook at internal infrastructure or specific IP addresses, causing the multi-tenant server to fetch it. The affected code is located in `app/presenters/v3/ApiAlertChannelPresenter.server.ts`, `app/v3/services/alerts/createAlertChannel.server.ts`, and `app/v3/services/alerts/deliverAlert.server.ts`.

Defensive priority

Defenders should prioritize verifying exposure of internal infrastructure to this SSRF, checking for usage of affected versions, and applying the provided patch or mitigation measures.

Recommended defensive actions

• Verify if internal infrastructure is exposed to this SSRF vulnerability
• Check if affected versions are in use and apply patch or mitigation measures
• Monitor for suspicious activity related to the alert channel webhook feature
• Perform asset inventory of systems using Trigger.dev
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerable code and affected versions. However, it does not provide explicit information on exploitation or specific victims. The CVE Program and NVD records offer additional context but do not provide further details on exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.