---
id: CVE-2026-114082
title: Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
summary: >-
  Trigger.dev before 4.6.2 contains an authorization vulnerability that allows
  public-token holders with session write access to obtain environment-wide S2
  stream credentials via session input initialization. Attackers can use the
  credenti…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-862
vendor: triggerdotdev
product: trigger.dev
affected:
  - trigger.dev < 4.6.2
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:49.960Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114082'
references:
  - url: >-
      https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-cpx8-cffg-mp4w
    label: GitHub Security Advisory (GHSA-cpx8-cffg-mp4w)
  - url: >-
      https://www.vulncheck.com/advisories/trigger-dev-before-4.6.2-overly-broad-realtime-session-stream-credentials
    label: >-
      VulnCheck Advisory: Trigger.dev before 4.6.2 Overly Broad Realtime Session
      Stream Credentials
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.022Z'
---

## Overview

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.

## Affected

- `trigger.dev < 4.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.