These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-114073 debrief: Trigger.dev Trigger CLI debug deployment logs expose resolved environment secret values. The vulnerability affects Trigger.dev versions 4.5.3 and below, allowing unredacted secret values to be logged in debug deployment logs. This exposure can lead to the recovery of deployment secrets by unauthorized parties with access to developer terminal transcripts, CI debug logs, or support [truncated]
CVE-2026-114079 debrief based on the supplied source corpus. The CVE record was published on 2026-10-02T22:42:40.000Z and has not been modified since then. The vulnerability affects Trigger.dev deployments, particularly those using multiple environments (e.g., dev, staging, prod), allowing unauthorized deployment cancellations across environments due to improper scoping of API keys. Defenders responsible [truncated]
CVE-2026-114086 debrief based on the supplied source corpus. The CVE record was published on 2026-10-02T22:39:57.000Z and has not been modified since then. The vulnerability allows unauthenticated data injection into realtime streams, with potential for data tampering and unauthorized data injection. Defenders and administrators of Trigger.dev instances, especially those with publicly accessible streams o [truncated]
CVE-2026-114087 debrief: Self-hosted trigger.dev v4 instances using default secrets from hosting/docker/.env.example are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise via forged magic links, allowing attackers to authenticate as any email address without email delivery. Defenders should assess exposure and prioritize remediation to prevent potential [truncated]
CVE-2026-114088 debrief based on the supplied source corpus. The CVE record was published on 2026-10-02T22:39:00.000Z and has not been modified since then. Operators of self-hosted Trigger.dev instances, security teams responsible for monitoring and patching vulnerabilities, and developers using Trigger.dev in their applications should be aware of this vulnerability and take necessary actions to secure th [truncated]
CVE-2026-114076 describes a blind Server-Side Request Forgery (SSRF) vulnerability in Trigger.dev, an open-source automation platform. The vulnerability arises from the lack of proper validation for user-supplied URLs in the alert channel webhook feature. An authenticated tenant can exploit this by pointing the webhook at internal infrastructure or specific IP addresses like `169.254.169.254`, causing the [truncated]
CVE-2026-73659 is a high-severity vulnerability in Trigger.dev, an open-source platform for building AI workflows in TypeScript. The issue, fixed in version 4.5.0, allows unauthorized access to offloaded task payloads and outputs across different organizations on multi-organization self-hosted instances due to a path traversal vulnerability in packet presign routes.
CVE-2026-73658 is a high-severity vulnerability in Trigger.dev, a platform for building and deploying AI agents and workflows. The issue allows a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys, potentially enabling unauthorized access to task payloads. This vulnerability was fixed in version 4.5.0-rc.5.
CVE-2026-73657 debrief based on the supplied source corpus. The CVE record was published on 2026-08-13T22:17:27.040Z and has not been modified since then. The vulnerability allows unauthorized replay of task runs across tenants in Trigger.dev, potentially leading to resource consumption and side effect repetition. This issue is fixed in version 4.5.0-rc.4. Defenders managing Trigger.dev environments, espe [truncated]
CVE-2026-73656 is a critical vulnerability in Trigger.dev, a platform for building and deploying AI agents and workflows. The issue allows an attacker with a valid API key for one project to manipulate another project's deployment by linking an attacker-owned background worker, potentially moving the victim's deployment from BUILDING to DEPLOYING. This vulnerability is fixed in version 4.5.6.
CVE-2026-73655 is a high-severity vulnerability in Trigger.dev, a platform for building and deploying AI agents and workflows. The issue, fixed in version 4.5.2, allows an attacker to take over an account by exploiting the addGoogleStrategy function, which does not require Google's email_verified assertion. This CVE was published on 2026-08-13T20:17:30.153Z and was last modified on 2026-09-18T20:09:01.757Z.
CVE-2026-73654 is a high-severity vulnerability in Trigger.dev, a platform for building and deploying AI agents and workflows. The vulnerability affects versions from 3.3.8 to 4.5.5 and allows an attacker with a normal environment API key to pollute Object.prototype in the shared webapp process. This can lead to corruption of Prisma queries and Prometheus labels, breaking other tenants' worker authenticat [truncated]
