CVE-2026-114074

The record

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.

Affected packages

Related vulnerabilities

• CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-918
• CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-918
• CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-918
• CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-918
• CVE-2026-55598 PinePods is a complete, self-hosted podcast management system written in Rust. CWE-918
• CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql's… CWE-918
• CVE-2026-61840 Quest Bot is an opensource Discord Bot. CWE-918
• CVE-2026-119712 PipesHub before 0.10.0 contains a server-side request forgery vulnerability in… CWE-918