Trigger.dev Security Bulletin CVE-2026-73656: SSRF, SSRF, Authorization Fixes, and Rate Limiting

Vulnerability Overview Vulnerability ID: CVE-2026-73656 Vulnerability Description: The Trigger.dev platform contains several security issues, including: - SSRF (Server-Side Request Forgery) - Stricter URL patterns for platform notifications - Tenant/environment-scoped batch, trigger, replay, and idempotency lookups - Per-table query authorization via the new TRQL table detector - Rate limiting for ai-side endpoints - Prompt override source normalization - Reduction of secrets in logs - Same-origin/CSP checks for environments, JWT context, Slack integration, and worker headers - Email allowlist pattern matcher for impersonation and batch-resume redirection - Extracted invite-level ladder utility - Working group project access checks - Google email verification enforcement - Refactored/testable MFA rate limiter - Extracted module - CLI fix to propagate the MCP server's flag - New unit tests and integration tests accompanying each change Scope of Impact Affected Components: - Webhook validation and fetch wrappers for alert delivery - Stricter URL patterns for platform notifications - Tenant/environment-scoped batch, trigger, replay, and idempotency lookups - Per-table query authorization - Rate limiting for ai-side endpoints - Prompt override source normalization - Reduction of secrets in logs - Same-origin/CSP checks for environments, JWT context, Slack integration, and worker headers - Email allowlist pattern matcher for impersonation and batch-resume redirection - Extracted invite-level ladder utility - Working group member access checks - Google email verification enforcement - Refactored/testable MFA rate limiter - Extracted module - CLI fix to propagate the MCP server's flag Remediation Fixes: - Implemented SSRF-safe webhook validation and fetch wrappers - Applied stricter URL patterns for platform notifications - Implemented tenant/environment-scoped batch, trigger, replay, and idempotency lookups - Implemented per-table query authorization via the new TRQL table detector - Implemented rate limiting for ai-side endpoints - Implemented prompt override source normalization - Reduced secrets in logs - Implemented same-origin/CSP checks for environments, JWT context, Slack integration, and worker headers - Implemented email allowlist pattern matcher for impersonation and batch-resume redirection - Extracted invite-level ladder utility - Implemented working group member access checks - Implemented Google email verification enforcement - Refactored/testable MFA rate limiter - Extracted module - CLI fix to propagate the MCP server's flag - Added new unit tests and integration tests POC Code or Exploitation Code No POC code or exploitation code Additional Information Release Date: 2026-07-06 Related Issue: #4199 Related PR: #4199 Related Commit: 3451a18 Related Branch: security-release/2026-07-06 Summary The Trigger.dev platform contains multiple security issues, including SSRF, stricter URL patterns, tenant/environment-scoped batch, trigger, replay, and idempotency lookups, per-table query authorization, rate limiting for ai-side endpoints, prompt override source normalization, reduction of secrets in logs, same-origin/CSP checks, email allowlist pattern matchers, invite-level ladder utilities, working group member access checks, Google email verification enforcement, MFA rate limiters, the module, and CLI fixes propagating the MCP server's flag. These issues have been resolved by implementing the corresponding security measures.

Goal Reached Thanks to every supporter — we hit 100%!

Trigger.dev Security Bulletin CVE-2026-73656: SSRF, SSRF, Authorization Fixes, and Rate Limiting

More from this source