High severity · published Oct 21, 2026
CVE-2026-114082
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114082
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114082
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-cpx8-cffg-mp4w
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.6.2-overly-broad-realtime-session-stream-credentials
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint