A blind server‑side request forgery exists in Trigger.dev versions prior to 4.5.2. The flaw arises when an authenticated tenant supplies an unvalidated webhook URL in an alert channel. This causes the application’s server to send POST requests to arbitrary internal hosts, providing the attacker a covert way to probe internal services, trigger state‑changing operations, or reach cloud metadata endpoints via redirects.

The vulnerability impacts the Trigger.dev platform developed by triggerdotdev. Versions of the application released before 4.5.2 are affected; all newer releases contain the fix.

With a CVSS score of 5.3, this flaw presents a moderate severity risk. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating low exploit probability in the wild. However, the attack requires authenticated access to a tenant account and allows directed internal traffic, which could be valuable to threat actors in a compromise scenario. The vulnerability is a blind SSRF, so detection is non‑obvious, making it a concern for environments with sensitive internal services.