CVE-2026-114090

HighCVSS 7.1

Published: 21/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 21/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

Risk Assessment

An attacker can perform operations on behalf of the developer, such as starting or canceling tasks and accessing logs, potentially leading to data breaches and application disruption. This may also enable further privilege escalation.

Recommendation

Update Trigger.dev CLI to version 4.5.4 or later. Restrict network access to the MCP server and enforce strong authentication.

Other vulnerabilities in Trigger.dev CLI

CVE-2026-114073Medium
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS