{"id":"CVE-2026-114090","kind":"vulnerability","aliases":["CVE-2026-114090"],"related":[],"title":"Trigger.dev CLI: MCP server exposes unauthenticated task control to the network","description":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.","summary":"The trigger dev --mcp server in the Trigger.dev CLI binds to all network interfaces and accepts MCP tool calls without authentication. A LAN attacker or a malicious web page can invoke trigger-task, cancel-run, list-runs and get-run-logs using the developer's stored access token.","severity":"high","cvss":7.6,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-code","local-dev","mcp","node","trigger.dev"],"not_affected_if":["isolated-network","mcp-flag-not-used","version-4.5.4-or-later"],"how_to_check":"- Run `npx trigger.dev@latest --version` or check the installed `trigger.dev` CLI version in the project's `package.json`, and compare it to `4.5.4`\n- Check whether `trigger dev --mcp` is run during development and whether port-binding on the host is reachable from other machines on the network","fix":"- Upgrade the Trigger.dev CLI (`@trigger.dev/cli` / `trigger.dev`) to `4.5.4` or later\n- Until upgraded, stop running `trigger dev --mcp` on shared or untrusted networks\n- Rotate the Trigger.dev access token if the MCP server was exposed while it was running","status":"open","published_at":"2026-10-21T01:17:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:14:26+00:00","updated_at":"2026-10-25T03:14:26+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:14:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Trigger.dev CLI (`@trigger.dev/cli` / `trigger.dev`) to `4.5.4` or later\n- Until upgraded, stop running `trigger dev --mcp` on shared or untrusted networks\n- Rotate the Trigger.dev access token if the MCP server was exposed while it was running","reach":"network","title":"Trigger.dev CLI: MCP server exposes unauthenticated task control to the network","impact":"medium","summary":"The trigger dev --mcp server in the Trigger.dev CLI binds to all network interfaces and accepts MCP tool calls without authentication. A LAN attacker or a malicious web page can invoke trigger-task, cancel-run, list-runs and get-run-logs using the developer's stored access token.","category":"ai-tooling","nicknames":[],"who_cares":["trigger.dev","mcp","claude-code","node","local-dev"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker triggers tasks and reads run logs using the developer's stored token","analyst_note":"Confirm the patched version and whether the advisory on the Trigger.dev GitHub repo lists the exact fixed release and any additional mitigations.","how_to_check":"- Run `npx trigger.dev@latest --version` or check the installed `trigger.dev` CLI version in the project's `package.json`, and compare it to `4.5.4`\n- Check whether `trigger dev --mcp` is run during development and whether port-binding on the host is reachable from other machines on the network","needs_analyst":true,"not_affected_if":["mcp-flag-not-used","isolated-network","version-4.5.4-or-later"],"who_is_affected":"Developers who run the Trigger.dev CLI from 3.0.0 up to but not including 4.5.4 with the trigger dev --mcp server enabled. The exposure is the MCP server listening on all interfaces, so developers on shared or office networks, or any machine a malicious web page can reach, are most at risk. Teams that never run the --mcp flag or only use the CLI on isolated machines can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":3416,"output_tokens":761,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114090':14A,17A '-2026':13A,16A '/messages':111C '/sse':109C '3.0.0':87C '4.5.4':89C 'accept':45B 'access':80B,145C 'ai':19B 'ai-tool':18B 'attack':53B,114C 'authent':50B,93C 'bind':39B,102C 'call':48B 'cancel':65B,130C 'cancel-run':64B,129C 'claud':22B 'claude-cod':21B 'cli':2A,38B,84C 'cli-v3':83C 'code':23B 'contain':90C 'control':8A 'cve':12A,15A 'dev':26B,32B,98C 'develop':77B,142C 'endpoint':112C 'expos':5A,107C 'get':72B,137C 'get-run-log':71B,136C 'interfac':43B,105C 'invok':60B,125C 'lan':52B,113C 'list':68B,133C 'list-run':67B,132C 'local':25B 'local-dev':24B 'log':74B,139C 'malici':56B,116C 'mcp':3A,27B,33B,46B,99C,121C 'miss':92C 'network':11A,42B,104C 'node':28B 'page':58B,118C 'request':123C 'run':66B,69B,73B,131C,134C,138C 'send':120C 'server':4A,34B,100C 'store':79B,144C 'task':7A,63B,128C 'token':81B,146C 'tool':20B,47B 'tools/call':122C 'trigger':31B,62B,97C,127C 'trigger-task':61B,126C 'trigger.dev':1A,29B,37B,82C 'unauthent':6A 'use':75B,140C 'v3':85C 'vulner':94C 'web':57B,117C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Developers who run the Trigger.dev CLI from 3.0.0 up to but not including 4.5.4 with the trigger dev --mcp server enabled. The exposure is the MCP server listening on all interfaces, so developers on shared or office networks, or any machine a malicious web page can reach, are most at risk. Teams that never run the --mcp flag or only use the CLI on isolated machines can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114090","severity":null,"published_at":"2026-10-21T01:17:33+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114090","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114090","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}