{"id":"CVE-2026-114067","kind":"vulnerability","aliases":["CVE-2026-114067"],"related":[],"title":"Trigger.dev: public session token lets users overwrite chat history snapshots","description":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.","summary":"Trigger.dev versions 4.5.0 before 4.6.2 expose a PUT snapshot-url session endpoint that accepts public session tokens instead of requiring the secret key. A user holding a public session token can obtain presigned S3 write URLs and overwrite their own durable chat snapshot, forging the agent's conversation history.","severity":"high","cvss":7.1,"epss":0.00221,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","package","self-hosted","trigger.dev","typescript"],"not_affected_if":["not-using-durable-sessions","version-outside-4.5.0-4.6.2"],"how_to_check":"- Check the installed Trigger.dev version with `npx trigger.dev@latest --version` or the `@trigger.dev/sdk` version in package.json; versions `4.5.0` through `4.5.x` are affected.\n- Confirm whether the application uses durable chat sessions with Trigger.dev agents, since that is the data path the endpoint serves.","fix":"- Upgrade Trigger.dev to `4.6.2` or later.\n- Until upgraded, unknown whether restricting session tokens or the snapshot-url route is a viable mitigation; the sources do not say.","status":"open","published_at":"2026-10-21T01:17:30+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:32:04+00:00","updated_at":"2026-10-25T03:32:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:32:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trigger.dev to `4.6.2` or later.\n- Until upgraded, unknown whether restricting session tokens or the snapshot-url route is a viable mitigation; the sources do not say.","reach":"internet","title":"Trigger.dev: public session token lets users overwrite chat history snapshots","impact":"medium","summary":"Trigger.dev versions 4.5.0 before 4.6.2 expose a PUT snapshot-url session endpoint that accepts public session tokens instead of requiring the secret key. A user holding a public session token can obtain presigned S3 write URLs and overwrite their own durable chat snapshot, forging the agent's conversation history.","category":"package","nicknames":[],"who_cares":["trigger.dev","self-hosted","ai-agents","typescript"],"confidence":0.7,"needs_auth":"yes","worst_case":"End users forge the agent's stored conversation history by overwriting their own snapshot.","analyst_note":"Confirm from the Trigger.dev 4.6.2 release notes or GitHub advisory whether the fix is the only remedy and whether the default configuration exposes the route.","how_to_check":"- Check the installed Trigger.dev version with `npx trigger.dev@latest --version` or the `@trigger.dev/sdk` version in package.json; versions `4.5.0` through `4.5.x` are affected.\n- Confirm whether the application uses durable chat sessions with Trigger.dev agents, since that is the data path the endpoint serves.","needs_analyst":true,"not_affected_if":["not-using-durable-sessions","version-outside-4.5.0-4.6.2"],"who_is_affected":"Teams running Trigger.dev 4.5.0 before 4.6.2 that use durable chat or agent sessions, where end users hold public session tokens and the agent's conversation snapshot is stored in S3. The exposure depends on the snapshot-url route being reachable with a public token; teams not using durable session snapshots are likely unaffected, but the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000708,"input_tokens":3387,"output_tokens":738,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114067':13A,16A '-2026':12A,15A '4.5.0':28B,77C '4.6.2':30B,79C 'accept':40B 'agent':19B,72B,119C 'ai':18B 'ai-ag':17B 'allow':94C 'author':83C 'chat':8A,68B,114C 'check':132C 'contain':80C 'convers':74B,121C 'cve':11A,14A 'durabl':67B,113C 'end':105C 'endpoint':38B,92C 'expos':31B 'forg':70B,117C 'histori':9A,75B,122C 'hold':52B 'holder':98C 'host':23B 'improp':82C 'instead':44B 'key':49B,130C 'lack':126C 'let':5A 'obtain':58B,100C 'overwrit':7A,64B,108C 'packag':20B 'presign':59B,101C 'public':2A,41B,54B,95C 'put':33B,87C 'requir':46B 'rout':125C 's3':60B,102C 'secret':48B,129C 'secret-key-on':128C 'self':22B 'self-host':21B 'session':3A,37B,42B,55B,91C,96C,111C 'sinc':123C 'snapshot':10A,35B,69B,89C,115C 'snapshot-url':34B,88C 'token':4A,43B,56B,97C 'trigger.dev':1A,24B,26B,76C 'typescript':25B 'url':36B,62B,90C,104C 'user':6A,51B,106C 'version':27B 'vulner':84C 'write':61B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running Trigger.dev 4.5.0 before 4.6.2 that use durable chat or agent sessions, where end users hold public session tokens and the agent's conversation snapshot is stored in S3. The exposure depends on the snapshot-url route being reachable with a public token; teams not using durable session snapshots are likely unaffected, but the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114067","severity":null,"published_at":"2026-10-21T01:17:30+00:00","modified_at":"2026-10-22T18:17:27+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114067","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114067","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}