Live › vulnerability › CVE-2026-114083
Go to dashboardTrigger.dev's packets presign endpoints (api/v1 and api/v2) put the request filename into the object-store key unchecked. With one valid API key, ../ sequences yield presigned GET/PUT URLs for other tenants' run payloads and outputs, so you can read or overwrite them. It is exploitable on the aws4fetch backend, which is used whenever static object-store access keys are set (the default for the bundled MinIO self-hosted stack). The AWS SDK/IAM-credential backend is not affected. A full PoC is published in the advisory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| trigger.dev | npm | <= 4.4.6 (CVE: < 4.5.0-rc.3) | 4.5.0-rc.3 |
4.4.6, CVE lists everything before 4.5.0-rc.3)4.5.0-rc.3 or later (the GHSA lists patched >= 4.5.0 for the sibling advisory; prefer a stable 4.5.0+).., %2e%2e and encoded variants in the path of /api/v1/packets and /api/v2/packets at your reverse proxy/load balancerEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114083")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.