---
id: "CVE-2026-114083"
kind: "vulnerability"
aliases: ["CVE-2026-114083"]
title: "Trigger.dev: path traversal lets one tenant read or overwrite others' payloads"
severity: "high"
cvss: 8.6
epss: 0.00351
exploited: false
status: "open"
category: "package"
products: [{"name": "trigger.dev", "fixed": ["4.5.0-rc.3"], "affected": "<= 4.4.6 (CVE: < 4.5.0-rc.3)", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["minio", "multi-tenant", "object-store", "package", "s3", "self-hosted", "trigger.dev"]
not_affected_if: ["iam-credential-chain", "managed-hosting", "single-tenant", "single-tenant-deployment"]
published_at: "2026-10-21T01:17:32+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114083", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:49:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114083", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: path traversal lets one tenant read or overwrite others' payloads

Trigger.dev's packets presign endpoints (api/v1 and api/v2) put the request filename into the object-store key unchecked. With one valid API key, ../ sequences yield presigned GET/PUT URLs for other tenants' run payloads and outputs, so you can read or overwrite them. It is exploitable on the aws4fetch backend, which is used whenever static object-store access keys are set (the default for the bundled MinIO self-hosted stack). The AWS SDK/IAM-credential backend is not affected. A full PoC is published in the advisory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:trigger.dev affected <= 4.4.6 (CVE: < 4.5.0-rc.3) fixed 4.5.0-rc.3

## How to check

Self-hosted: check the webapp image/version (<= 4.4.6, CVE lists everything before 4.5.0-rc.3). Check whether OBJECT_STORE_ACCESS_KEY_ID / OBJECT_STORE_SECRET_ACCESS_KEY are set (vulnerable aws4fetch backend). If your object store is shared by several orgs/projects, you are exposed. Check object-store access logs for GET/PUT keys under packets/<other project>/ reached via presigned URLs.

## Fix

Upgrade the self-hosted webapp to 4.5.0-rc.3 or later (the GHSA lists patched >= 4.5.0 for the sibling advisory; prefer a stable 4.5.0+). Until then, block '..', '%2e%2e' and encoded variants in the path of /api/v1/packets and /api/v2/packets at your reverse proxy/load balancer. Consider rotating secrets that appeared in run payloads if untrusted tenants had accounts.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114083
- 2026-10-23T23:49:50+00:00 analyst — Read GHSA-gx7f-q62h-9fxp (CVE's referenced advisory) and sibling GHSA-888c-px7m-736v. Unconfirmed: PoC is in the advisory itself; no exploitation reports; did not search social. Sibling advisory says managed cloud was shielded by an AWS ALB filter on '..' variants (not a code fix; no vendor statement read on cloud patch). Advisories disagree on fixed version: 4.5.0-rc.3 vs >=4.5.0; 4.4.2 lower bound only in one.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114083

## Documents

- [advisory] GHSA-gx7f-q62h-9fxp: path traversal in packets presign (<= 4.4.6, fixed 4.5.0-rc.3) https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp
- [describes] GHSA-888c-px7m-736v: cross-tenant object store read/write (4.4.2-4.4.6; cloud note) https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-888c-px7m-736v
- [mentions] CVE record CVE-2026-114083 (VulnCheck CNA) https://www.cve.org/CVERecord?id=CVE-2026-114083

## From the sources

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_