---
id: "CVE-2026-114089"
kind: "vulnerability"
aliases: ["CVE-2026-114089"]
title: "Trigger.dev: CSRF in CLI login flow lets attackers steal access tokens"
severity: "high"
cvss: 8.8
epss: 0.00148
exploited: false
status: "open"
category: "package"
products: [{"name": "trigger.dev", "fixed": ["4.5.2"], "affected": "<= 4.5.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["account-takeover", "cli", "csrf", "other", "package", "self-hosted", "trigger.dev"]
not_affected_if: ["managed-hosting-patched", "version-4.5.2-or-later"]
published_at: "2026-10-21T01:17:33+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114089", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:49:47+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114089", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: CSRF in CLI login flow lets attackers steal access tokens

Trigger.dev <=4.5.1: loading /account/authorization-code/<code> as a logged-in user mints a Personal Access Token with no consent step; the attacker, who created the code via the unauthenticated API, collects the PAT from /api/v1/token and takes over the account. The same advisory reports missing org-role checks and a cross-org removeTeamMember IDOR, which make a stolen PAT more damaging. Reporter says it hits the managed cloud and self-hosted instances.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:trigger.dev affected <= 4.5.1 fixed 4.5.2

## How to check

Self-hosted: check the webapp image/version and the trigger.dev CLI/package version (npx trigger.dev --version); anything <= 4.5.1 is affected. Review your account's Personal Access Tokens in the dashboard for ones you did not create.

## Fix

Upgrade self-hosted Trigger.dev and the CLI to 4.5.2 or later (4.5.6 adds explicit browser approval for CLI/MCP login). Revoke and re-create PATs that may have been minted via unexpected authorization-code links; rotate prod tr_prod_* API keys if a PAT was exposed.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114089
- 2026-10-23T23:49:47+00:00 analyst — Vendor GHSA-58mc-m3qq-6qrh: <=4.5.1 affected, >=4.5.2 fixed; affects managed cloud and self-hosted per reporter; cloud patch status not stated by vendor. PoC curl chain is in the advisory; no exploitation reported. v4.5.6 later added explicit browser approval for CLI/MCP login. X/social not searched.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114089

## Documents

- [advisory] GHSA-58mc-m3qq-6qrh: CLI auth-code phishing → PAT takeover (<=4.5.1, fixed 4.5.2) https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-58mc-m3qq-6qrh
- [describes] CVE Record CVE-2026-114089 https://www.cve.org/CVERecord?id=CVE-2026-114089
- [fix] trigger.dev v4.5.6 release (explicit browser approval for CLI/MCP login) https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6

## From the sources

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_