CVE-2026-114082High· 8.1▾ TwilightTrigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credenti…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
trigger.dev < 4.6.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114071Low· 3.1Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
CVE-2026-85651High· 8.5Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments
GHSA-pp95-gc86-jq6qHigh· 7.1Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
GHSA-gg6r-gp4c-89hpCriticalTrigger.dev: V1 coordinator default-secret unauth Socket.IO
CVE-2026-114065Medium· 6.5Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints