CVE-2026-114090 trigger.dev CVE debrief

Who should care

Defenders responsible for Trigger.dev CLI deployments, particularly those using versions 3.0.0 before 4.5.4, should assess exposure and prioritize remediation. This includes verifying the version of Trigger.dev CLI in use, restricting access to MCP server endpoints, and monitoring for suspicious activity. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest

Why it matters

CVE-2026-114090 is a high-severity vulnerability in Trigger.dev CLI versions 3.0.0 before 4.5.4. The vulnerability allows LAN attackers or malicious web pages to send MCP tool requests, potentially invoking trigger tasks, canceling runs, listing runs, and retrieving run logs using the developer's stored access token. Defenders should prioritize verifying and upgrading to version 4.5.4 or later, restricting access to MCP server endpoints, and monitoring for suspicious activity.

• Potential unauthorized invocation of trigger tasks
• Possible cancellation of runs without authorization
• Potential exposure of run logs
• Possible listing of runs without authorization

Technical summary

The Trigger.dev CLI versions 3.0.0 before 4.5.4 contain a missing authentication vulnerability in the MCP server. This allows unauthorized access to /sse and /messages endpoints, potentially enabling LAN attackers or malicious web pages to invoke trigger tasks, cancel runs, list runs, and retrieve run logs using the developer's stored access token. The vulnerability is due to the MCP server binding all network interfaces and exposing sensitive endpoints without authentication. Defenders should prioritize verifying and upgrading to version 4.5.4 or later, restricting access to MCP server endpoints, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and upgrading to version 4.5.4 or later, restricting access to MCP server endpoints, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and upgrade Trigger.dev CLI to version 4.5.4 or later
• Restrict access to MCP server endpoints
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Trigger.dev CLI versions 3.0.0 before 4.5.4. The MCP server binds all network interfaces and exposes sensitive endpoints without authentication. This allows LAN attackers or malicious web pages to send MCP tool requests, potentially invoking trigger tasks, canceling runs, listing runs, and retrieving run logs using the developer's stored access token. Defenders should verify the version of Trigger.dev CLI in use and assess exposure. The MCP server's lack of authentication is a critical issue that must

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.