CVE-2026-114070 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, especially those using version 4.5.0, should assess exposure and prioritize verification and remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update Trigger.dev to version 4.6.0 or later, and monitor for potential token compromise.

Why it matters

CVE-2026-114070 is a medium-severity information disclosure vulnerability affecting Trigger.dev versions 4.5.0 before 4.6.0, allowing potential token compromise and replay for environment JWT exchange.

• Potential token compromise and replay for environment JWT exchange
• Information disclosure via browser-readable session input records
• Verification of Trigger.dev deployments for version 4.5.0 exposure
• Remediation priority for updating to version 4.6.0 or later

Technical summary

The vulnerability is caused by the Dashboard Agent input proxy storing a delegated user-actor token in browser-readable session input records. An attacker holding a chat's public session token can exploit this vulnerability to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange. This affects Trigger.dev versions 4.5.0 before 4.6.0, and defenders should prioritize verifying exposure of Trigger.dev deployments, especially those using version 4.5.0, and assess the feasibility of token compromise.

Defensive priority

Defenders should prioritize verifying exposure of Trigger.dev deployments, especially those using version 4.5.0, and assess the feasibility of token compromise.

Recommended defensive actions

• Verify Trigger.dev deployments for version 4.5.0 and assess exposure
• Review and update Trigger.dev to version 4.6.0 or later
• Monitor for potential token compromise and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its location in the Dashboard Agent input proxy and the potential impact of token disclosure. Defenders should verify Trigger.dev deployments for version 4.5.0 exposure and assess the feasibility of token compromise. The vulnerability allows potential token compromise and replay for environment JWT exchange, and information disclosure via browser-readable session input records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.