EUVD-2026-106886
GHSA-r9qj-p24x-r8fw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid tenant API key
-
ExploitInject ../ in packets filename splat
-
ExecutionReceive presigned GET/PUT URL for foreign prefix
-
ImpactRead or overwrite other tenants' run payloads
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to hold one valid Trigger.dev API key (any tenant), i.e. authenticated tenant access, per CVSS PR:L - not anonymous access. The concrete trigger is supplying ../ path-traversal sequences in the unsanitized filename splat segment of the api/v1/packets or api/v2/packets presigned-URL endpoints; no special non-default configuration is named, so default deployments of versions before 4.5.0-rc.3 are affected. The practical limiting factors are: (1) a valid API key is needed, and (2) impact is meaningful only on shared/multi-tenant instances - on a single-tenant self-hosted deployment there are no other tenants' objects to reach, substantially reducing real-world risk there. |
| Impact | This is a credible, prioritize-for-patching issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) is internally consistent with the description: exploitation is network-reachable against the packets API, low-complexity (simple ../ injection in a path splat), and requires only PR:L - a single valid API key for any tenant, which is trivially obtainable on a multi-tenant SaaS or self-hosted shared instance. The high confidentiality AND integrity impact is justified because an attacker can both read (presigned GET) and overwrite (presigned PUT) other tenants' run payloads and outputs, breaking tenant isolation. Signals are limited: no EPSS score, KEV status, or POC indicator was provided in the input, so there is no evidence of active exploitation or public exploit code at this time - the risk is driven by the low exploitation barrier and severe impact, not by observed weaponization. The main caveat is that real-world blast radius depends on deployment model: a shared multi-tenant instance is far more exposed than a single-tenant self-hosted deployment where all data already belongs to one owner. |
| Exploit ScenarioDerived | An attacker signs up for or otherwise obtains one legitimate Trigger.dev API key, then calls the api/v1/packets or api/v2/packets endpoint supplying ../ sequences in the filename splat segment to escape their assigned object-key prefix. The server returns a presigned GET or PUT URL scoped to another tenant's object path, letting the attacker read sensitive run payloads/outputs or overwrite them with malicious content. No POC or active exploitation was indicated in the provided data, but the attack requires only low-complexity request crafting. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach.
RemediationAI
Vendor-released patch: upgrade to Trigger.dev 4.5.0-rc.3 or later (track the corresponding stable 4.5.0 GA once available) from https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-gx7f-q62h-9fxp; the fix normalizes/validates the filename segment so resolved object keys cannot escape the tenant prefix, and it applies to both the v1 and v2 packet routes, so partial upgrades that leave one API generation in place do not close the hole. Because a valid API key is the only prerequisite, treat key hygiene as part of remediation: rotate API keys issued to tenants you cannot fully vouch for, and review keys with broad project scope, since revocation invalidates in-flight workers (expect job failures until they re-authenticate). Audit object-storage access logs and packet presigned-URL request logs for '../' or percent-encoded traversal sequences ('%2e%2e%2f', '..%2f') and for GET/PUT keys outside the requesting tenant's prefix; detection is retrospective, so pair it with key rotation. Where immediate upgrade is not possible, compensating controls are limited and carry trade-offs: front the packet endpoints with a proxy/WAF rule that rejects any filename segment containing '.' or '%2e' sequences (blocks the known exploit shape but can break legitimate filenames containing dots and will miss novel encodings), restrict network reachability of the API to trusted worker egress ranges (reduces exposed surface but does not stop a malicious tenant already inside that range), and on self-hosted single-tenant instances document that residual risk is low because no other tenants' objects exist to traverse into. Upgrading remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Trigger.dev is a background-jobs and workflow-orchestration platform that persists run payloads and outputs in object storage (S3-compatible), issuing short-lived presigned GET and PUT URLs so workers can upload inputs and download results. The packet endpoints build an object key from a tenant/project prefix plus a user-supplied filename splat segment, and the pre-4.5.0-rc.3 code passes that segment into key construction without normalization or prefix enforcement. Inserting ../ sequences therefore produces a key outside the caller's prefix, and the storage backend faithfully signs a presigned URL for that resolved key. This is classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) applied to object-store key namespaces rather than a filesystem: the root cause is missing canonicalization plus a failure to assert the final key still begins with the tenant prefix. Because both the v1 and v2 packet routes share the defect, the exposure spans both API generations. Per the assessed vector the impact is high confidentiality and integrity loss (VC:H/VI:H) with no availability effect (VA:N) and no scope change, consistent with read/overwrite of other tenants' run payloads and outputs without destroying the service. The CPE cpe:2.3:a:triggerdotdev:trigger.dev:*:*:*:*:*:*:*:* uses a wildcard version, indicating all releases below the fixed build are considered affected.
Know when Trigger Dev gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network API reachable (AV:N), trivial ../ injection (AC:L), needs a valid tenant API key (PR:L), no user interaction; read and overwrite of other tenants' data gives C:H/I:H, no availability loss, same security authority so S:U.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
Technical POC Analysis
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Trigger.dev's presigned-URL packet endpoints contain a path traversal flaw that lets any authenticated low-privilege API key holder escape their tenant prefix and read or overwrite other tenants' run payloads and outputs in shared or multi-tenant deployments. Leadership should care because this breaks tenant isolation and exposes sensitive execution data and outputs across customers, with high confidentiality and integrity impact; single-tenant self-hosted instances are not materially exposed. No public exploit code or CISA KEV listing was identified at time of analysis, but the absence of a stable vendor patch raises risk for multi-tenant operators.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and rotate API keys, enforce tenant object-key prefix validation at the gateway or reverse proxy, disable presigned-URL packet endpoints if not needed, segment network access, and monitor api/v1/packets and api/v2/packets for cross-tenant access; upgrade to 4.5.0-rc.3 or later when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Trigger.dev Authorization and Injection Flaws
View all 29More in Trigger Dev
View allPrototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corru
Cross-tenant authorization bypass in Trigger.dev before 4.5.6 lets a caller holding a valid API key for one project act
Missing authorization on the run replay API endpoint in Trigger.dev before 4.5.2 allows authenticated attackers to injec
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding
Exploit-DB