CVE-2026-114067 triggerdotdev CVE debrief

Who should care

Trigger.dev users and administrators should assess their exposure and take necessary actions to prevent potential misuse of session tokens. This includes upgrading to version 4.6.2 or later and monitoring for potential session token misuse. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impact on their systems.

Why it matters

Trigger.dev users and administrators should assess exposure and upgrade to version 4.6.2 or later to prevent potential misuse of session tokens

• Public session token holders can obtain presigned S3 write URLs
• End users can overwrite their own session's durable chat snapshot

Technical summary

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint. This vulnerability allows public session token holders to obtain presigned S3 write URLs, potentially enabling end users to overwrite their own session's durable chat snapshot and forge the agent's conversation history. The vulnerability is considered HIGH severity with a CVSS score of 7.1. Users and administrators of Trigger.dev should assess their exposure and upgrade to version 4.6.2 or later to prevent potential misuse of session tokens.

Defensive priority

Trigger.dev users should assess exposure and upgrade to version 4.6.2 or later

Recommended defensive actions

• Assess exposure by checking current Trigger.dev version
• Upgrade to Trigger.dev version 4.6.2 or later
• Monitor for potential session token misuse
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the improper authorization vulnerability in Trigger.dev 4.5.0 before 4.6.2. The vulnerability is confirmed in the official CVE Program record and NIST NVD detail page. The source item record also provides additional context on the vulnerability. However, the exact scope and potential impact of the vulnerability are limited by the information available in these sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.