---
id: "CVE-2026-114067"
kind: "vulnerability"
aliases: ["CVE-2026-114067"]
title: "Trigger.dev: public session token lets users overwrite chat history snapshots"
severity: "high"
cvss: 7.1
epss: 0.00221
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ai-agents", "package", "self-hosted", "trigger.dev", "typescript"]
not_affected_if: ["not-using-durable-sessions", "version-outside-4.5.0-4.6.2"]
published_at: "2026-10-21T01:17:30+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:32:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114067", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114067", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: public session token lets users overwrite chat history snapshots

Trigger.dev versions 4.5.0 before 4.6.2 expose a PUT snapshot-url session endpoint that accepts public session tokens instead of requiring the secret key. A user holding a public session token can obtain presigned S3 write URLs and overwrite their own durable chat snapshot, forging the agent's conversation history.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Trigger.dev version with `npx trigger.dev@latest --version` or the `@trigger.dev/sdk` version in package.json; versions `4.5.0` through `4.5.x` are affected.
- Confirm whether the application uses durable chat sessions with Trigger.dev agents, since that is the data path the endpoint serves.

## Fix

- Upgrade Trigger.dev to `4.6.2` or later.
- Until upgraded, unknown whether restricting session tokens or the snapshot-url route is a viable mitigation; the sources do not say.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114067
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114067

## From the sources

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_