CVE-2026-114086

Deferred Deferred - Pending Action

Authentication Bypass in Trigger.dev Real-Time Streams

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114086

EUVD

EUVD-2026-106889

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-114086 is a missing authentication vulnerability in Trigger.dev versions before 4.5.5. It allows unauthenticated attackers to inject arbitrary data into realtime streams by sending POST requests to a specific endpoint using a predictable run ID. The flaw occurs because the handler lacks authentication and does not restrict access to specific environments.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to the endpoint /realtime/v1/streams/:runId/:streamId. Check if unauthenticated requests are reaching this endpoint, especially with predictable run friendlyId patterns like run_1234abcd. Inspect logs for unusual data injection attempts in realtime streams.

Impact Analysis

This vulnerability could allow attackers to inject malicious or misleading data into realtime streams, potentially affecting application behavior or user interactions. Since it affects production environments, it may lead to data corruption, misinformation, or disruption of services relying on realtime updates.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA due to unauthorized data injection in realtime streams. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates secure handling of protected health information. Unauthorized data injection may violate these requirements by compromising data integrity and exposing sensitive information.

Mitigation Strategies

Immediately upgrade trigger.dev to version 4.5.5 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /realtime/v1/streams/:runId/:streamId endpoint by implementing authentication and environment scoping. Review and block suspicious POST requests to this endpoint.

Hi! I’m here to help you understand CVE-2026-114086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...