{"id":"CVE-2026-114089","kind":"vulnerability","aliases":["CVE-2026-114089"],"related":[],"title":"Trigger.dev: CSRF in CLI login flow lets attackers steal access tokens","description":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.","summary":"Trigger.dev <=4.5.1: loading /account/authorization-code/<code> as a logged-in user mints a Personal Access Token with no consent step; the attacker, who created the code via the unauthenticated API, collects the PAT from /api/v1/token and takes over the account. The same advisory reports missing org-role checks and a cross-org removeTeamMember IDOR, which make a stolen PAT more damaging. Reporter says it hits the managed cloud and self-hosted instances.","severity":"high","cvss":8.8,"epss":0.00148,"exploited":false,"exploited_at":null,"products":[{"name":"trigger.dev","fixed":["4.5.2"],"affected":"<= 4.5.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["account-takeover","cli","csrf","other","package","self-hosted","trigger.dev"],"not_affected_if":["managed-hosting-patched","version-4.5.2-or-later"],"how_to_check":"Self-hosted: check the webapp image/version and the trigger.dev CLI/package version (npx trigger.dev --version); anything <= 4.5.1 is affected. Review your account's Personal Access Tokens in the dashboard for ones you did not create.","fix":"Upgrade self-hosted Trigger.dev and the CLI to 4.5.2 or later (4.5.6 adds explicit browser approval for CLI/MCP login). Revoke and re-create PATs that may have been minted via unexpected authorization-code links; rotate prod tr_prod_* API keys if a PAT was exposed.","status":"open","published_at":"2026-10-21T01:17:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:28+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Trigger.dev to 4.5.2 or later. Revoke any personal access tokens that may have been minted from unexpected authorization-code links.","reach":"internet","title":"Trigger.dev: CSRF in CLI login flow lets attackers steal access tokens","impact":"high","summary":"Trigger.dev before 4.5.2 mints a Personal Access Token when a logged-in user opens a crafted authorization-code URL, with no consent step. An attacker can retrieve that token and take over the victim's account.","category":"package","who_cares":["trigger.dev","self-hosted","cli"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker takes over a logged-in user's account using their stolen personal access token.","analyst_note":"Confirm the affected package and version range from the NVD entry or the Trigger.dev release notes, and whether the self-hosted app or only the CLI is affected.","how_to_check":"Check the installed Trigger.dev version (the self-hosted app or the CLI package) and confirm whether it is below 4.5.2.","needs_analyst":true,"not_affected_if":["version-4.5.2-or-later"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000518,"input_tokens":2972,"output_tokens":442,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected version range and whether hosted Trigger.dev cloud was patched, using the NVD entry and the Trigger.dev release notes for 4.5.2.","search":"'-114089':14A,17A '-2026':13A,16A '/account/authorization-code':33B,124C '/api/v1/token':63B,157C '4.5.1':31B '4.5.2':106C 'access':10A,43B,128C 'account':20B,68B,163C 'account-takeov':19B 'advisori':71B 'api':58B 'attack':8A,50B,134C 'author':119C 'authorization-cod':118C 'check':77B 'cli':4A,22B,117C 'cloud':98B 'code':54B,120C,138C 'collect':59B 'consent':47B,132C 'contain':107C 'creat':52B 'cross':81B,110C 'cross-org':80B 'cross-sit':109C 'csrf':2A,23B 'cve':12A,15A 'damag':91B 'endpoint':158C 'flow':6A,121C 'forgeri':113C 'hit':95B 'host':28B,102B 'idor':84B 'instanc':103B 'let':7A 'load':32B,123C 'log':37B,142C 'logged-in':36B,141C 'login':5A 'lure':139C 'make':86B 'manag':97B 'mint':40B,125C,135C 'miss':73B 'org':75B,82B 'org-rol':74B 'packag':25B 'pat':61B,89B,153C 'person':42B,127C 'removeteammemb':83B 'report':72B,92B 'request':112C 'retriev':149C 'role':76B 'say':93B 'self':27B,101B 'self-host':26B,100B 'site':111C 'steal':9A 'step':48B,133C 'stolen':88B 'take':65B,160C 'takeov':21B 'token':11A,44B,129C 'trigger.dev':1A,18A,29B,30B,104C 'unauthent':57B,137C,156C 'url':147C 'user':39B,144C 'via':55B 'victim':151C 'vulner':114C 'without':130C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114089","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114089","severity":null,"published_at":"2026-10-21T01:17:33+00:00","modified_at":"2026-10-21T01:17:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114089:526","url":null,"severity":null,"published_at":"2026-10-23T23:49:47+00:00","modified_at":"2026-10-23T23:49:47+00:00","first_seen_at":"2026-10-23T23:49:47+00:00","fetched_at":"2026-10-23T23:49:47+00:00","note":"Vendor GHSA-58mc-m3qq-6qrh: <=4.5.1 affected, >=4.5.2 fixed; affects managed cloud and self-hosted per reporter; cloud patch status not stated by vendor. PoC curl chain is in the advisory; no exploitation reported. v4.5.6 later added explicit browser approval for CLI/MCP login. X/social not searched."},{"source":"epss","external_id":"CVE-2026-114089","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114089","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":2183,"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-58mc-m3qq-6qrh","title":"GHSA-58mc-m3qq-6qrh: CLI auth-code phishing → PAT takeover (<=4.5.1, fixed 4.5.2)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2185,"url":"https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6","title":"trigger.dev v4.5.6 release (explicit browser approval for CLI/MCP login)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2189,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114089","title":"CVE Record CVE-2026-114089","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}