CVE-2026-114075 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments should assess exposure and verify the version in use. They should also review access controls and monitor for suspicious activity related to alert channel creation.

Why it matters

CVE-2026-114075 is an authorization bypass vulnerability in Trigger.dev before version 4.5.12 that could allow attackers to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure. Defenders should prioritize verifying the version in use, reviewing access controls, and monitoring for suspicious activity.

• Defenders need to verify the version of Trigger.dev in use and upgrade to version 4.5.12 or later to prevent potential authorization bypass.
• Defenders should review and restrict access to the alertChannels endpoint to prevent unauthorized channel creation.
• Defenders should monitor for suspicious activity related to alert channel creation to detect potential exploitation.
• Defenders may need to investigate and remediate potential security incidents related to alert channel creation.

Technical summary

The vulnerability is caused by an authorization bypass in the Alert Channels API of Trigger.dev before version 4.5.12. This allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. An attacker with a read-only user-actor token could potentially create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.

Defensive priority

Defenders should prioritize verifying the version of Trigger.dev in use and upgrading to version 4.5.12 or later. They should also review and restrict access to the alertChannels endpoint, and monitor for suspicious activity related to alert channel creation.

Recommended defensive actions

• Verify the version of Trigger.dev in use and upgrade to version 4.5.12 or later
• Review and restrict access to the alertChannels endpoint
• Monitor for suspicious activity related to alert channel creation
• Perform a thorough review of existing alert channels for potential security incidents
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, there is limited information on potential exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.