CVE-2026-114086
CVE-2026-114086 · Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.
CVSS 6.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.5: Affected (semver)
- 4.5.5: Not affected (semver)
Update to 4.5.5
trigger.dev npm
- Affected ranges
- SEMVER: < 4.5.5
Update to 4.5.5