EUVD-2026-58480Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable API requires a valid tenant API key (PR:L), key enumeration introduces genuine complexity (AC:H), and cross-tenant data access constitutes a scope change (S:C) with full read/write payload impact (C:H/I:H) and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5.
AnalysisAI
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding a valid environment API key to obtain presigned AWS S3 URLs scoped to another tenant's object-store keys, enabling unauthorized read and write access to task payloads. The flaw combines user-controlled packet path keys written directly into URL.pathname without dot-segment rejection and a stub ownership check (findResource: async () => 1) that unconditionally returns truthy for any requested resource. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid Trigger.dev environment API key for any tenant on the target instance - the attacker must be an authenticated low-privilege user, not an external unauthenticated actor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score with S:C (scope changed) accurately reflects the real-world severity: a tenant-authenticated attacker in one security domain can cross into another tenant's storage domain, which is a meaningful and directly impactful boundary violation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a valid Trigger.dev environment API key for their own tenant crafts a packet path containing dot-segment traversal sequences - for example ../../victim-project-ref/prod/sensitive-payload-key - and submits it to the /api/v1/packets/* or /api/v2/packets/* endpoint. Because WHATWG URL normalization in URL.pathname collapses the traversal before the request is processed and the findResource stub always returns truthy, the server generates and returns a valid AWS presigned URL scoped to the victim tenant's S3 key. … |
| Remediation | The primary fix is to upgrade to Trigger.dev v4.5.0-rc.5 or later, as documented at https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.0-rc.5 and in security advisory GHSA-888c-px7m-736v. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify your Trigger.dev version and identify all instances running versions 4.4.2 or later; simultaneously enable enhanced S3 access logging to detect cross-tenant requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Trigger Dev
View allPrototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corru
Cross-tenant authorization bypass in Trigger.dev before 4.5.6 lets a caller holding a valid API key for one project act
Path traversal in Trigger.dev's packet presign API routes (versions 4.4.2 through 4.4.x) allows a holder of any valid pr
Account takeover in Trigger.dev before 4.5.2 allows an unauthenticated remote attacker to hijack any existing user accou
Cross-tenant run replay in Trigger.dev 4.4.2-4.5.0-rc.3 allows any authenticated API key holder to replay task runs belo
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today