Trigger.dev EUVD-2026-107018

Exploitation requires the attacker to hold a valid public session token for an active Trigger.dev chat session (PR:L) and to reach the PUT snapshot-url session endpoint over the network; the endpoint lacks a secret-key-only authorization check, so any session-token holder is served a presigned S3 write URL. Affected deployments are Trigger.dev versions 4.5.0 up to (not including) 4.6.2. The key limiting factor is scope: a token holder can only overwrite their own session's durable chat snapshot, so impact is restricted to forging that user's own agent conversation history rather than tampering with other tenants' data; there is no confidentiality or availability impact and no cross-session reach.

This is a genuine but moderate-severity integrity issue rather than a top-tier emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privilege credential - a public session token - with impact confined to integrity (VI:H) and no confidentiality (VC:N) or availability (VA:N) effect, and no scope change to other systems (SC/SI/SA:N). The score of 7.1 is driven entirely by the high integrity impact of letting a session holder forge their own agent conversation history; there is no code execution, data exfiltration, or cross-tenant impact described. No EPSS probability, CISA KEV listing, POC, or SSVC data was provided in the input, so there is no signal of active exploitation or automatability - at time of analysis this reads as a theoretical/authorization-correctness bug reported by a research vendor (VulnCheck), not a mass-exploited threat. The PR:L rating is consistent with the description's 'public session token holders' requirement, so the signals are internally coherent. Net: a legitimate fix-worthy authorization gap, but lower operational urgency than the 7.1 alone might suggest because the attacker can only tamper with their own session's data.

A user holding a valid public session token for a Trigger.dev chat session calls the PUT snapshot-url session endpoint, which fails to enforce a secret-key-only check and returns a presigned S3 write URL. The user uses that URL to overwrite their own session's durable chat snapshot, fabricating or altering the agent's recorded conversation history to misrepresent what the agent said or did. No public exploit identified at time of analysis.