CVE-2026-114083 triggerdotdev CVE debrief

Who should care

Defenders and security teams responsible for Trigger.dev instances, especially those with sensitive data or multiple tenants, should assess exposure and apply necessary patches or mitigations.

Why it matters

CVE-2026-114083 is a path traversal vulnerability in Trigger.dev before 4.5.0-rc.3 that allows authenticated tenants to access sensitive data, requiring defenders to verify exposure and apply patches or mitigations.

• Verify Trigger.dev version and patch or mitigate if necessary to prevent unauthorized access
• Restrict access to authenticated API key holders to reduce attack surface
• Monitor presigned URL activity for suspicious behavior

Technical summary

The vulnerability exists in the api/v1/packets and api/v2/packets endpoints of Trigger.dev before 4.5.0-rc.3, allowing authenticated tenants to supply ../ sequences and obtain presigned GET or PUT URLs. This enables attackers to read or overwrite other tenants' run payloads and outputs, posing a significant risk to sensitive data. Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on authenticated API key holders and tenants with sensitive data. The vulnerability is a path traversal issue that allows attackers to escape their object key prefix.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on authenticated API key holders and tenants with sensitive data.

Recommended defensive actions

• Verify Trigger.dev version and apply patches or mitigations if necessary
• Restrict access to authenticated API key holders
• Monitor for suspicious activity on presigned URLs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the path traversal vulnerability, while source references offer additional context and potential mitigations. The vulnerability allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment, enabling them to read or overwrite other tenants' run payloads and outputs. Defenders should verify exposure and apply patches or mitigations, focusing on authenticated API key holders and tenants with sensitive data. The CVE record was published on 2026

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.