CVE-2026-114070

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114070

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114070.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114070

Aliases

GHSA-wpp9-mq73-fhqm

Published

2026-10-21T00:36:41Z

Modified

2026-10-21T10:46:32Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Details

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-522"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114070.json"
}

References

Affected packages

Git / github.com/triggerdotdev/trigger.dev

Affected ranges

Type

GIT

Repo

https://github.com/triggerdotdev/trigger.dev

Events

Introduced

86ef3c49799a3de399a0534b5ca7c7244c72caa4

Fixed

6172bcd1bc67044a295aa41acb49d92db954de3d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "4.5.0"
                },
                {
                    "fixed":  "4.6.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

Other

docs-release-2026-07-02

docs-release-2026-07-09

docs-release-2026-07-14

docs-release-2026-07-23

docs-release-2026-08-07

docs-release-2026-08-13

docs-release-2026-08-17

docs-release-2026-08-28

docs-release-2026-08-28-2

docs-release-2026-08-31

docs-release-2026-09-01

docs-release-2026-09-08

docs-release-20260707-1007

docs-release-20260714-1409

re2-prod-supervisor-2026-08-18

re2-prod-supervisor-callback-auth-v1

re2-prod-supervisor-cffaa05

re2-prod-supervisor-dispatch-url

re2-prod-supervisor-heatwave-dualwrite

re2-prod-supervisor-tri-11473

re2-test-supervisor-2026-08-18

re2-test-supervisor-callback-auth-v1

re2-test-supervisor-enforcement-mode-metric

re2-test-supervisor-main-2496a8a8

re2-test-supervisor-main-c526528

re2-test-supervisor-main-cffaa05

re2-test-supervisor-run-crd

re2-test-supervisor-runtime-uid

re2-test-supervisor-tri-11473

helm-v4.*

helm-v4.5.0

helm-v4.5.1

helm-v4.5.10

helm-v4.5.11

helm-v4.5.12

helm-v4.5.13

helm-v4.5.14

helm-v4.5.15

helm-v4.5.16

helm-v4.5.2

helm-v4.5.3

helm-v4.5.4

helm-v4.5.5

helm-v4.5.6

helm-v4.5.7

helm-v4.5.8

helm-v4.5.9

v.*

v.docker.4.5.0

v.docker.4.5.1

v.docker.4.5.10

v.docker.4.5.11

v.docker.4.5.12

v.docker.4.5.13

v.docker.4.5.14

v.docker.4.5.15

v.docker.4.5.16

v.docker.4.5.2

v.docker.4.5.3

v.docker.4.5.4

v.docker.4.5.5

v.docker.4.5.6

v.docker.4.5.7

v.docker.4.5.8

v.docker.4.5.9

v4.*

v4.5.0

v4.5.1

v4.5.10

v4.5.11

v4.5.12

v4.5.13

v4.5.14

v4.5.15

v4.5.16

v4.5.2

v4.5.3

v4.5.4

v4.5.5

v4.5.6

v4.5.7

v4.5.8

v4.5.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114070.json"