CVE-2026-114082: falha de alta gravidade em triggerdotdev trigger.dev
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.3%
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
triggerdotdev · trigger.devCVEs relacionadas — triggerdotdev trigger.dev
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.6%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-114083HIGHTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL EndpointsEPSS 0.5%