CVE-2026-114089

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Trigger.dev

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then retrieve the victim's PAT from the unauthenticated /api/v1/token endpoint to take over the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114089

EUVD

EUVD-2026-106892

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Trigger.dev before version 4.5.2 has a cross-site request forgery (CSRF) vulnerability in its CLI authorization-code flow. Attackers can create an unauthenticated authorization code, trick a logged-in user into visiting a malicious URL, and automatically generate a Personal Access Token (PAT) without the user's consent. The attacker can then retrieve the victim's PAT from an unauthenticated endpoint to take over the account.

Detection Guidance

Monitor for unauthorized PAT generation by checking logs for /account/authorization-code/<code> endpoint access and /api/v1/token requests. Look for suspicious URLs containing /account/authorization-code/ in web server logs or proxy logs.

Impact Analysis

An attacker could gain full control over your Trigger.dev account by tricking you into clicking a malicious link. They could then perform destructive actions like deleting organizations, rotating API keys, or removing team members, including admins from other organizations. This could lead to data loss, unauthorized access, and disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. It may result in unauthorized disclosure of personal or health data, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.2 or later immediately. Review all PATs for unauthorized access and revoke any suspicious tokens. Implement additional consent steps for PAT generation and enforce role-based access controls for destructive actions.

Hi! I’m here to help you understand CVE-2026-114089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...