Trigger.dev prior to version 4.5.10 permits authenticated project members to bypass the platform’s built‑in webhook SSRF safeguards by sending requests to IP addresses within the 198.18.0.0/15 benchmarking range, which the safety filter normally excludes. This allows the attacker to craft alert‑channel webhooks that resolve to services inside the target organization’s internal network. The plugin can then perform blind probes and send limited state‑changing POST requests, giving the attacker visibility into and the ability to manipulate internal services without direct network access.

All projects hosted on Trigger.dev that are running any version earlier than 4.5.10 are affected. The vendor, Trigger.dev, does not specify wider product line variations, but any instance of the platform before the stated upgrade date is vulnerable.

The CVSS score of 5.3 classifies the flaw as medium severity, while the EPSS score of less than 1% indicates a very low probability of observed exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated project member, meaning the threat is limited to users with membership privileges. However, once authenticated, the attacker can probe internal hosts and perform limited state changes, which could expose sensitive resources or lead to further lateral movement within the organization’s network.