---
id: CVE-2026-114074
title: >-
  Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15
  Range
summary: >-
  Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability
  that allows authenticated project members to bypass webhook SSRF protections
  by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can
  confi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.5.10
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T15:29:28.187467Z'
exploitAvailable: true
published: '2026-10-21'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T15:30:10.464Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114074'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fhh4-xvj5-m7pq
    label: GitHub Security Advisory (GHSA-fhh4-xvj5-m7pq)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.5.10-webhook-ssrf-protection-bypass-via-198.18.0.0-15-range
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.5.10 Webhook SSRF Protection
      Bypass via 198.18.0.0/15 Range
tags:
  - cve.org
  - exploit-available
epss: 0.00255
epssPercentile: 0.17042
ingestedAt: '2026-10-21T01:37:08.025Z'
---

## Overview

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.

## Affected

- `trigger.dev < 4.5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.