Live › vulnerability › CVE-2026-114086
Go to dashboardTrigger.dev before 4.5.5 has a missing authentication check on the realtime streams POST handler. An unauthenticated attacker who guesses a run friendlyId can inject arbitrary data into any environment's realtime stream, including production.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a Trigger.dev version before 4.5.5 that serve the realtime streams API, most likely self-hosted instances reachable from the internet or untrusted networks. Teams on the managed cloud service or on 4.5.5 or later are not exposed by this flaw, as far as the sources say; confirm with the vendor if unsure.
No product ranges from the sources yet.
npx trigger.dev@latest --version or by reading the @trigger.dev/sdk version in package.json./realtime/v1/streams/ route to the internet.4.5.5 or later./realtime/v1/streams/ at the proxy or network layer.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.
This page as .md · .json · in your agent: get_signal("CVE-2026-114086")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.