CVE-2026-114086 triggerdotdev CVE debrief

Who should care

Defenders and administrators of Trigger.dev instances, especially those with publicly accessible streams or predictable run friendlyIds, should assess exposure and prioritize mitigation.

Why it matters

CVE-2026-114086 is a critical vulnerability in Trigger.dev that allows unauthenticated data injection into realtime streams. Defenders should prioritize verifying and mitigating this vulnerability, especially in environments with publicly accessible streams or predictable run friendlyIds. The vulnerability allows for data tampering and unauthorized data injection, and verification of run friendlyId predictability and stream accessibility is necessary.

• Unauthenticated data injection into realtime streams
• Cross-environment access due to lack of scoping
• Potential for data tampering or unauthorized data injection
• Verification of run friendlyId predictability and stream accessibility

Technical summary

The Trigger.dev realtime stream endpoint has no authentication, allowing any entity that knows or guesses a run friendlyId to inject arbitrary data into its realtime stream. The run lookup uses predictable patterns, and production runs are accessible without environment scoping. The vulnerability allows for data tampering and unauthorized data injection, and verification of run friendlyId predictability and stream accessibility is necessary. The source corpus provides details on the vulnerable endpoint, lack of authentication, and predictable run friendlyId patterns.

Defensive priority

Defenders should prioritize verifying and mitigating this unauthenticated data injection vulnerability in Trigger.dev realtime streams, especially for environments with publicly accessible streams or predictable run friendlyIds.

Recommended defensive actions

• Verify and update Trigger.dev to version 4.5.5 or later
• Restrict access to realtime streams with authentication and authorization
• Monitor for suspicious activity on Trigger.dev instances
• Review and update run friendlyId generation to prevent predictability
• Implement additional logging and monitoring to detect potential exploitation
• Conduct a thorough review of the Trigger.dev instance's configuration and security controls
• Ensure that all Trigger.dev instances are up-to-date with the latest security patches

Evidence notes

The source corpus provides details on the vulnerable endpoint, lack of authentication, and predictable run friendlyId patterns. However, it does not provide explicit information on exploitation or specific victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.