---
id: "CVE-2026-114090"
kind: "vulnerability"
aliases: ["CVE-2026-114090"]
title: "Trigger.dev CLI: MCP server exposes unauthenticated task control to the network"
severity: "high"
cvss: 7.6
epss: 0.00205
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "claude-code", "local-dev", "mcp", "node", "trigger.dev"]
not_affected_if: ["isolated-network", "mcp-flag-not-used", "version-4.5.4-or-later"]
published_at: "2026-10-21T01:17:33+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:14:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114090", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114090", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev CLI: MCP server exposes unauthenticated task control to the network

The trigger dev --mcp server in the Trigger.dev CLI binds to all network interfaces and accepts MCP tool calls without authentication. A LAN attacker or a malicious web page can invoke trigger-task, cancel-run, list-runs and get-run-logs using the developer's stored access token.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npx trigger.dev@latest --version` or check the installed `trigger.dev` CLI version in the project's `package.json`, and compare it to `4.5.4`
- Check whether `trigger dev --mcp` is run during development and whether port-binding on the host is reachable from other machines on the network

## Fix

- Upgrade the Trigger.dev CLI (`@trigger.dev/cli` / `trigger.dev`) to `4.5.4` or later
- Until upgraded, stop running `trigger dev --mcp` on shared or untrusted networks
- Rotate the Trigger.dev access token if the MCP server was exposed while it was running

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114090
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114090

## From the sources

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_