trigger.dev CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH trigger.dev CVE published 2026-10-21

CVE-2026-114090

CVE-2026-114090 is a high-severity vulnerability in Trigger.dev CLI versions 3.0.0 before 4.5.4. The vulnerability is due to missing authentication in the MCP server, which exposes /sse and /messages endpoints. This allows LAN attackers or malicious web pages to send MCP tool requests, potentially invoking trigger tasks, canceling runs, listing runs, and retrieving run logs using the developer's stored access token.