Live › vulnerability › CVE-2026-114075
Go to dashboardTrigger.dev versions before 4.5.12 let holders of a read-only user-actor token create alert channels through the legacy personal access token helper. An attacker can route future deployment and error alerts to infrastructure they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or cloud Trigger.dev installations running a version before 4.5.12 where user-actor tokens are issued to people or systems that should only have read access. Exposure depends on whether read-only tokens exist outside trusted hands. Teams on a patched version can skip it.
No product ranges from the sources yet.
4.5.124.5.12 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.
This page as .md · .json · in your agent: get_signal("CVE-2026-114075")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.