What is the CVSS score of CVE-2026-114090?

CVE-2026-114090 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-114090?

Within 24 hours, identify which teams run the Trigger.dev CLI at versions 3.0.0 through 4.5.3 and instruct them to stop using 'trigger dev --mcp' mode entirely until further notice, since no vendor-released patch exists for any version in the 3.0.0-4.5.3 range; where MCP mode cannot be paused, require developers to work only on trusted wired networks, enable the host firewall to block inbound connections to the MCP listener port from anything other than loopback, and confirm the server is not bound to 0.0.0.0. Within 7 days, inventory Trigger.dev access tokens held on developer workstations and replace broad, long-lived tokens with least-privilege credentials scoped to development environments only, remove production-scoped tokens from laptops, and ask engineering to review recent run activity - cancellations, unexpected task triggers, and log retrievals - for anomalies attributable to an adjacent-network or browser-based attacker. Within 30 days, track Trigger.dev's release notes for a cli-v3 build later than 4.5.3 and mandate upgrade to the first fixed version as soon as it is published, re-baseline developer endpoint firewall rules to deny inbound access to local MCP ports by default, and add a standing requirement that CLI tooling exposing local servers be bound to loopback and authenticated before being permitted on corporate endpoints.

Trigger.dev CLI CVE-2026-114090

Q: Which versions of Trigger.dev CLI are affected by CVE-2026-114090?

Trigger.dev's CLI MCP server, shipped in cli-v3 versions 3.0.0 through 4.5.3, lacks authentication on its local /sse and /messages endpoints, allowing anyone sharing a network segment with a…. A patch is available.

EUVD-2026-106893 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-10-21 VulnCheck

GHSA-8v2q-27xw-2fjh

Authentication Bypass Trigger Dev Cli V3

7.6

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain LAN position or lure developer to malicious page
Delivery

Reach exposed /sse and /messages MCP endpoints
Exploit

Send unauthenticated MCP tools/call request
Execution

Invoke trigger-task/cancel-run/list-runs/get-run-logs with stored token
Impact

Exfiltrate run logs and manipulate tasks

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the developer to be actively running the Trigger.dev CLI in MCP mode ('trigger dev --mcp'), which binds the MCP server to all network interfaces (0.0.0.0) and exposes the unauthenticated /sse and /messages endpoints; a valid developer access token must already be stored locally for the invoked tools to act. The attacker must either hold an adjacent-network (LAN) position or induce the developer to load a malicious web page that can reach the bound port (reflected in AT:P). Limiting factors: the window is confined to active local development sessions while the MCP server is live, exploitation ceases once the dev process stops, and the flaw is fixed in cli-v3 4.5.4 and later.
Impact	This is a genuine but contextually-bounded risk rather than an internet-wide emergency. The CVSS 4.0 base score of 7.6 (HIGH) is driven by missing authentication (CWE-306) combined with high confidentiality and integrity impact (VC:H/VI:H) from abuse of the developer's stored access token. Key mitigating signals temper this: the attack vector is Adjacent (AV:A), not Network, so an attacker must share the LAN - or alternatively lure the developer to a malicious web page that reaches the bound interface - and the vector carries AT:P (an attack requirement is present), reflecting that the vulnerable '--mcp' dev server must be actively running. There is no CISA KEV listing and no public exploit code identified in the provided intelligence, so this is not confirmed as actively exploited; EPSS was not supplied. The vector reports PR:N (unauthenticated), which is consistent with the description: the MCP server itself requires no authentication. Net assessment: prioritize for developers/teams known to use Trigger.dev's local MCP mode, but it does not carry the blast radius of a remotely reachable server flaw.
Exploit ScenarioDerived	A developer runs 'trigger dev --mcp', which binds the MCP server to all interfaces and exposes /sse and /messages without authentication. An attacker on the same LAN - or a malicious web page the developer visits that reaches the bound port - sends MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, or get-run-logs, abusing the developer's stored access token. No public exploit code was identified at the time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 21, 2026

Missing authentication in the Trigger.dev CLI MCP server (cli-v3 3.0.0 through 4.5.3) exposes the /sse and /messages endpoints to adjacent-network attackers or malicious web pages while a developer runs 'trigger dev --mcp'. An unauthenticated attacker able to reach the bound port can issue MCP tools/call requests that use the developer's locally stored access token to trigger tasks, cancel runs, list runs, and retrieve run logs; exploitation is limited to active MCP-mode development sessions, and no public exploit was identified at time of analysis.

RemediationAI

Vendor-released patch: 4.5.4. Upgrade Trigger.dev cli-v3 to 4.5.4 or later, which fixes the missing authentication in the MCP server; see the vendor advisory GHSA-pqmg-rq46-vm4m at https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqmg-rq46-vm4m. If upgrade cannot be done immediately, stop any 'trigger dev --mcp' session when MCP tooling is not actively needed, and block access to the MCP port from adjacent networks using host firewall rules; because the server binds all interfaces, restricting it to loopback or an isolated development network reduces exposure, but these are compensating controls rather than a substitute for the 4.5.4 fix. Do not browse untrusted web pages while an MCP-mode dev server is reachable, and avoid running the CLI with a stored access token on untrusted networks.

Affected VersionsENISA

cli-v3 3.0.0 <4.5.4

Affected Packages

euvd cli_v3 fix: 4.5.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Trigger.dev CLI is a local development tool; its MCP mode starts an HTTP/SSE server and binds it to all network interfaces. CWE-306 (Missing Authentication for Critical Function) means the /sse and /messages MCP endpoints do not require authentication, so any process that can reach the port may submit MCP tools/call requests. Because the CLI has a stored developer access token, those requests can invoke tools such as trigger-task, cancel-run, list-runs, and get-run-logs with the developer's privileges. The attack surface is constrained to local development sessions where 'trigger dev --mcp' is running; the CVSS:4.0 vector uses AV:A/PR:N/UI:N with AT:P, reflecting an adjacent-network path or a malicious page able to reach the bound port. The affected product is identified by CPE cpe:2.3:a:trigger.dev:cli-v3:*:*:*:*:*:*:*:*.

Know when Trigger Dev gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 7.6 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today AI 8.3 HIGH

MCP server requires no authentication (PR:N) but demands adjacent-network reach or a malicious page hitting the bound port (AV:A); token abuse yields high confidentiality/integrity and low availability impact via cancel-run.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Oct 21, 2026 - 02:01 EUVD

CVE Published

Oct 21, 2026 - 00:36 cve.org

HIGH 7.6

DescriptionCVE.org

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

Technical POC Analysis

CWE-306, missing authentication for a critical function, in Trigger.dev's CLI dev MCP server.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

Trigger.dev's CLI MCP server, shipped in cli-v3 versions 3.0.0 through 4.5.3, lacks authentication on its local /sse and /messages endpoints, allowing anyone sharing a network segment with a developer - or a malicious web page that developer visits - to act using that developer's stored Trigger.dev access token while an MCP development session is active. Exposure is confined to engineers running 'trigger dev --mcp', but the reachable actions (triggering and cancelling runs, enumerating runs, and pulling run logs) extend to every environment the individual's token can access, so leadership should treat this as a developer-workstation risk with a potential path into shared staging or production workflows rather than a compromise of Trigger.dev itself. No vendor patch is available, so risk must be contained through configuration, network restrictions, and token hygiene until a fixed CLI release ships.

Business Impact: Medium

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: suspend use of 'trigger dev --mcp' on cli-v3 versions 3.0.0 through 4.5.3, or restrict it to isolated/loopback-only operation with host firewall rules blocking inbound connections to the MCP port; prohibit MCP-mode development on public Wi-Fi, untrusted or shared networks, and while browsing arbitrary web content; replace workstation Trigger.dev tokens with short-lived, least-privilege credentials scoped only to development environments; monitor Trigger.dev run activity and audit logs for unexpected task triggers, cancellations, run enumeration, and log retrieval; and rotate any token suspected of exposure.

Threat Intelligence Overview

EPSS Score

0.2%

Top 90% exploitable

Prevalence

Low

developer CLI tool; vulnerable MCP mode only active during local development

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.