Medium severity · published Oct 21, 2026
CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
4.5.0 before 4.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114067
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pc95-gc74-wg87
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-4.5.0-before-4.6.2-improper-authorization-via-snapshot-url-session-route
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint