CVE-2026-73658

Received Received - Intake

Path Traversal in Trigger.dev Object Store

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73658

Affected Vendors & Products

Vendor	Product	Version / Range
trigger.dev	aws4fetchclient	From 4.4.2 (inc) to 4.5.0-rc.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Trigger.dev allows a user with a valid API key to manipulate URL paths to access or modify another tenant's object-store data. The issue occurs because the application does not properly validate or normalize user-controlled input in URL paths, enabling path traversal attacks through dot segments (..) that are collapsed during URL signing.

Detection Guidance

This vulnerability involves improper handling of path segments in URL construction and signing. To detect it, inspect applications using Trigger.dev versions between 4.4.2 and 4.5.0-rc.5 for path normalization issues in URL generation. Check logs for unusual access patterns or unauthorized access to object-store keys. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read or overwrite another user's task payloads or stored data. This could lead to unauthorized access to sensitive information, data corruption, or disruption of workflows managed by the Trigger.dev platform.

Compliance Impact

This vulnerability could lead to violations of data protection regulations like GDPR or HIPAA by enabling unauthorized access to personal or sensitive data. Organizations using Trigger.dev may face compliance risks, including data breaches, loss of data confidentiality, and potential regulatory penalties.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.0-rc.5 or later to address the vulnerability in Aws4FetchClient and API handling.

Hi! I’m here to help you understand CVE-2026-73658. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70