CVE-2026-114082: trigger.dev 0 to before 4.6.2

Affected technology

trigger.dev · 0 to before 4.6.2
triggerdotdev

Description’s affected range: before 4.6.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as none; integrity and availability impact as high.