CVE-2026-114075

Deferred Deferred - Pending Action

Authorization Bypass in Trigger.dev Allows Alert Channel Creation

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114075

EUVD

EUVD-2026-107026

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Trigger.dev before version 4.5.12 has an authorization bypass flaw where users with restricted read-only user-actor tokens (UAT) can create alert channels by exploiting a legacy personal access token helper. This allows attackers to set up production webhook channels that route deployment and error alerts to their own infrastructure.

Detection Guidance

Check for unauthorized alert channels in Trigger.dev by reviewing project settings and API logs. Look for POST requests to /api/v1/projects/:projectRef/alertChannels with legacy personal access tokens. Inspect webhook URLs and secrets for unexpected destinations.

Impact Analysis

Attackers could intercept sensitive alert data, including deployment and error notifications, by rerouting them to attacker-controlled systems. This could lead to unauthorized access to project configurations and metadata, though availability remains unaffected.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using affected versions may face compliance risks due to potential data leaks.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.12 or later. Review and remove any unauthorized alert channels. Rotate all personal access tokens and user-actor tokens. Monitor for suspicious POST requests to alert channel endpoints.

Hi! I’m here to help you understand CVE-2026-114075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...