CVE-2026-114067

Deferred Deferred - Pending Action

Improper Authorization in Trigger.dev Session Endpoint

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114067

EUVD

EUVD-2026-107018

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Trigger.dev versions 4.5.0 to 4.6.1 have an improper authorization flaw in the PUT snapshot-url session endpoint. Users with a public session token can obtain presigned S3 write URLs and overwrite their session's durable chat snapshot, forging the agent's conversation history. The route lacks a secret-key-only check, allowing unauthorized modifications to session data.

Detection Guidance

To detect this vulnerability, check if your trigger.dev instance is running versions 4.5.0 through 4.6.1. Inspect network logs for PUT requests to /api/v1/sessions/:sessionId/snapshot-url endpoints. Verify if public session tokens are being used for write operations without secret-key-only checks.

Impact Analysis

An attacker with a public session token could modify their own chat history, making the AI agent appear to have said or done things it never did. This could lead to misinformation, reputational damage, or confusion in recorded interactions. The impact is limited to the attacker's own session.

Compliance Impact

This vulnerability primarily impacts data integrity by allowing forgery of conversation history. For GDPR, it could violate principles of accuracy and integrity of personal data. For HIPAA, it may compromise the integrity of recorded interactions. Compliance depends on how session data is used and stored.

Mitigation Strategies

Upgrade Trigger.dev to version 4.6.2 or later to apply the patch addressing the improper authorization flaw.
Review and restrict access to the PUT /api/v1/sessions/:sessionId/snapshot-url endpoint to ensure only authorized users can modify session data.
Monitor for unusual activity in session snapshots or S3 write operations, particularly those originating from public session tokens.

Hi! I’m here to help you understand CVE-2026-114067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...