CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

What is CVE-2026-114082?

CVE-2026-114082 is a high-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.

Official description

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.

Weakness: CWE-862

Which versions are affected by CVE-2026-114082?

How do I fix CVE-2026-114082?

No fix has been published for CVE-2026-114082 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114082 being exploited?

There is no known exploitation of CVE-2026-114082 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-cpx8-cffg-mp4w, GHSA-rwgj-7gch-9v4q.