Live › vulnerability › CVE-2026-114090
Go to dashboardThe trigger dev --mcp server in the Trigger.dev CLI binds to all network interfaces and accepts MCP tool calls without authentication. A LAN attacker or a malicious web page can invoke trigger-task, cancel-run, list-runs and get-run-logs using the developer's stored access token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Developers who run the Trigger.dev CLI from 3.0.0 up to but not including 4.5.4 with the trigger dev --mcp server enabled. The exposure is the MCP server listening on all interfaces, so developers on shared or office networks, or any machine a malicious web page can reach, are most at risk. Teams that never run the --mcp flag or only use the CLI on isolated machines can skip it.
No product ranges from the sources yet.
npx trigger.dev@latest --version or check the installed trigger.dev CLI version in the project's package.json, and compare it to 4.5.4trigger dev --mcp is run during development and whether port-binding on the host is reachable from other machines on the network@trigger.dev/cli / trigger.dev) to 4.5.4 or latertrigger dev --mcp on shared or untrusted networksEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.
This page as .md · .json · in your agent: get_signal("CVE-2026-114090")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.