Live › vulnerability › CVE-2026-114082
Go to dashboardTrigger.dev before 4.6.2 lets a holder of a public token with session write access obtain environment-wide S2 stream credentials through session input initialization. An attacker can use those credentials against the storage API to append, create, or trim other sessions' and runs' streams, forging output or permanently deleting records.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run self-hosted Trigger.dev before 4.6.2 and expose public tokens with session write access. The sources do not say which deployment modes beyond that are affected, and the unknown items above cover what they leave out.
No product ranges from the sources yet.
npx trigger.dev@latest --version or the version in package.json) and see whether it is below 4.6.24.6.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
This page as .md · .json · in your agent: get_signal("CVE-2026-114082")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.