Trigger.dev CVE-2026-114070

Exploitation requires that the attacker already possesses a valid public session token for a specific chat in a Trigger.dev 4.5.0-4.5.x deployment using the Dashboard Agent input proxy; with that token the attacker reads the in records endpoint where the delegated userActorToken is stored in browser-readable session input records (payload.metadata.userActorToken). Limiting factors: the vulnerability is gated by possession of the chat session token (CVSS PR:L, not unauthenticated), involves passive user interaction (UI:P), affects only the narrow version band 4.5.0 up to but not including 4.6.0, and is specific to deployments exercising the Dashboard Agent input proxy chat feature; it is fully remediated by upgrading to 4.6.0.

This is a medium-severity credential-exposure issue (CWE-522), not a top-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N) shows network reach and low attack complexity, but two signals materially cap real-world risk: PR:L means the attacker must already hold a valid chat public session token (authenticated, not anonymous), and UI:P indicates some passive user interaction is in play. Confidentiality impact is only Low and there is no integrity or availability impact, consistent with disclosure of a single delegated token rather than full compromise. No EPSS score, KEV listing, or POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis,' so there is no evidence of active or automated exploitation. The chief caveat is scope escalation: the recovered userActorToken can be replayed for environment JWT exchange, so the practical blast radius depends on what that delegated actor token authorizes within the victim's Trigger.dev environment - the base CVSS low impact may understate downstream access. Treat as a prompt-but-routine patch, prioritized above baseline for multi-tenant or shared-environment deployments.

An attacker who has obtained a chat's public session token (e.g., a shared or leaked chat link in a multi-tenant Trigger.dev 4.5.0 deployment) queries the Dashboard Agent input proxy's records endpoint and reads payload.metadata.userActorToken from the browser-readable session input records. They then replay that delegated user-actor token against the environment JWT exchange to assume the delegated actor's access. No public POC or active exploitation was indicated in the provided data.