Product

Trigger.dev (<= 4.5.5)

1 brief RSS

Trigger.dev SSRF via Unvalidated Webhook Delivery URLs

An authenticated user can configure malicious webhook endpoints in Trigger.dev (< 4.5.2) to perform server-side request forgery (SSRF) against internal services and cloud metadata endpoints.

trigger.dev +2 authorization-bypass insecure-design cloud-security web-vulnerability self-hosted authentication-bypass idor broken-access-control +1

3r 7t 6d ago