CVE-2026-92773highCWE-639

CVE-2026-92773: falha de alta gravidade em triggerdotdev trigger.dev

Trigger.dev before 4.6.0 GitHub App Installation Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar trigger.dev

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Produtos afetados
triggerdotdev · trigger.dev
CVEs relacionadas — triggerdotdev trigger.dev

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.6%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-114083HIGHTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL EndpointsEPSS 0.5%