CVE-2026-114067Medium· 6.5▾ SunlitTrigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own sessio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.
trigger.dev >= 4.5.0 < 4.6.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114075Medium· 5.4Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API
CVE-2026-114065Medium· 6.5Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
CVE-2026-114068High· 8.3Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
CVE-2026-114069High· 8.1Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
CVE-2026-114070Low· 3.5Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records