CVE-2026-114083

Deferred Deferred - Pending Action

Path Traversal in Trigger.dev API Endpoints

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114083

EUVD

EUVD-2026-106886

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-114083 is a path traversal vulnerability in Trigger.dev versions before 4.5.0-rc.3. It affects the api/v1/packets and api/v2/packets endpoints. Authenticated tenants can exploit unsanitized filename segments to escape their object key prefix using ../ sequences. This allows generating presigned URLs to read or overwrite other tenants' run payloads and outputs.

Detection Guidance

Check Trigger.dev logs for unusual access patterns to api/v1/packets or api/v2/packets endpoints with ../ sequences in filenames. Inspect presigned URL generation requests for path traversal attempts. Monitor for unauthorized reads or writes to packet objects outside expected tenant directories.

Impact Analysis

An attacker with a valid API key can access or modify other tenants' sensitive data, including API tokens, database credentials, and personally identifiable information (PII). This could lead to data breaches, unauthorized access, or service disruption for affected tenants.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA. It enables unauthorized access to sensitive personal data, which could result in legal penalties, loss of trust, and failure to meet regulatory obligations for data confidentiality and integrity.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.0-rc.5 or later immediately. Implement input validation to reject filenames containing ../ sequences. Review and revoke any potentially exposed presigned URLs. Audit all packet objects for unauthorized access or modifications.

Hi! I’m here to help you understand CVE-2026-114083. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...