Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: triggerdotdev trigger.dev 4.5.2 Clear all filters
TI-2026-78702 CVE-2026-114089

Cross-site request forgery in Trigger.dev CLI leads to token theft

Priority HIGH 73

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00201 Published 2026-10-21 Fixed in 4.5.2 CWE-352
TI-2026-78693 CVE-2026-114080

Blind SSRF in Trigger.dev alert-channel webhook URL

Priority LOW 24

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00336 Published 2026-10-21 Fixed in 4.5.2 CWE-918
TI-2026-78689 CVE-2026-114076

Blind SSRF in Trigger.dev via alert channel webhook URL

Priority MEDIUM 57

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0033 Published 2026-10-21 Fixed in 4.5.2 CWE-918