CVE-2026-73659 triggerdotdev CVE debrief

Who should care

Defenders of Trigger.dev instances, especially those with self-hosted multi-organization environments, should assess exposure and apply the patch to prevent unauthorized data access.

Why it matters

CVE-2026-73659 is a high-severity vulnerability in Trigger.dev that allows unauthorized access to offloaded task payloads and outputs across different organizations on multi-organization self-hosted instances. Defenders should prioritize verifying exposure and applying the patch to prevent data breaches.

• Verify Trigger.dev instance version and patch level to prevent unauthorized data access
• Assess and limit exposure of self-hosted multi-organization environments
• Monitor for suspicious activity related to offloaded task payloads and outputs

Technical summary

The vulnerability exists in packet presign routes of Trigger.dev versions between 4.4.2 and 4.5.0, allowing .. traversal attacks. This enables project API keys to read or overwrite offloaded task payloads and outputs of other organizations on multi-organization self-hosted instances. Defenders should prioritize verifying exposure of Trigger.dev instances, especially self-hosted multi-organization environments, and apply the patch to prevent unauthorized data access. The issue is fixed in version 4.5.0 and defenders should assess and limit exposure of self-hosted multi-organization environments.

Defensive priority

Defenders should prioritize verifying exposure of Trigger.dev instances, especially self-hosted multi-organization environments, and apply the patch to prevent unauthorized data access.

Recommended defensive actions

• Verify Trigger.dev instance version and apply patch to prevent unauthorized data access
• Assess exposure of self-hosted multi-organization environments
• Monitor for suspicious activity related to offloaded task payloads and outputs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional verification is required to determine the full scope of affected instances and potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.