CVE-2026-114082 Details
Description
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
An authorization vulnerability exists in Trigger.dev versions prior to 4.6.2. This vulnerability allows public-token holders with session write access to obtain environment-wide S2 stream credentials through session input initialization. The acquired credentials can be used directly with the storage API to append, create, or trim other session and run streams, potentially forging output or permanently deleting records.
Users are advised to upgrade to Trigger.dev version 4.6.2 or later. After upgrading, revoke any previously issued credentials that may have been affected by this vulnerability, or allow their default lifetime of 24 hours to elapse. For environments still using the vulnerable version, prevent untrusted callers from initializing session streams.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Trigger.dev | < 4.6.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |