Trigger.dev CVE-2026-114086

Exploitation requires the attacker to send a POST request to the /realtime/v1/streams/:runId/:streamId endpoint and to know or guess a valid run friendlyId, which uses a predictable format (e.g., run_1234abcd); no authentication headers are needed because the action handler was left unauthenticated for backwards compatibility with older clients, and no runtimeEnvironmentId scoping is applied so cross-environment (including production) streams are reachable. The primary limiting factor is the need to know/guess a valid friendlyId, and the impact is capped to injecting (writing) data into a run's realtime stream - it does not grant read access, code execution, or service disruption. Affected only on Trigger.dev versions before 4.5.5.

This is a genuine but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack requiring no user interaction, which is why it scores 6.9 (Medium) despite the auth bypass - the impact metrics are the limiting factor (VI:L only; VC:N, VA:N), meaning the flaw permits only low-integrity data injection with no confidentiality or availability loss. Exploitation status is 'publicly available exploit code exists' (a working curl PoC is published in the GHSA advisory by VulnCheck) but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread in-the-wild exploitation at this time. The signals are internally consistent: a trivially exploitable unauthenticated endpoint, but with a capped integrity-only impact and a practical prerequisite (knowing/guessing a run friendlyId). Net: prioritize patching because exploitation is trivial and PoC is public, but this is not a full system-compromise emergency - treat it as a Medium that is cheap to fix rather than a critical RCE.

An unauthenticated attacker who knows or guesses a valid run friendlyId (which follows the predictable pattern run_<id>) sends a crafted POST request to /realtime/v1/streams/:runId/:streamId and injects arbitrary data into that run's realtime stream, including production environment streams, because the handler performs no auth check and no environment scoping. A public PoC (curl one-liner) exists, so exploitation requires no custom tooling. The injected data could mislead downstream consumers of the stream or poison application logic that trusts realtime stream content.