Trigger.dev versions before 4.5.2 allow a server‑side request forgery attack through webhook alert‑channel delivery URLs. The URLs are fetched by the server without any validation or SSRF protection. An authenticated user who is a member of an organization can create alert channels with arbitrary URLs, enabling the server to perform POST requests to internal services or protected metadata endpoints, potentially exposing sensitive data or changing internal state.

The vulnerability impacts Trigger.dev – specifically any deployment using the trigger.dev platform with a version older than 4.5.2. Users of Trigger.dev that have membership within an organization are capable of creating the vulnerable alert channels.

The CVSS score of 5.3 indicates a medium level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no publicly known exploits exist at this time. Exploitation requires only an authenticated organization member account; once authenticated, the attacker can craft an alert‑channel URL pointing to an internal resource, leading the server to issue an unvalidated POST request. No external network connection is needed beyond the internal network that the server can reach.