CVE-2026-114082
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders…
- Risk score
- 52/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and r…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.6.2 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
Last activity 21 Oct 2026. Patch Forecast updates every hour.