CVE-2026-114086Medium· 5.3▾ SunlitTrigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.
trigger.dev < 4.5.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-59h8-w5q6-mfmpMedium· 5.3Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
CVE-2026-114085High· 7.9Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
CVE-2026-114092Medium· 6.5Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
CVE-2026-114065Medium· 6.5Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
CVE-2026-114068High· 8.3Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint