Key points
- Trigger.dev versions before 4.5.2 are affected by CVE-2026-114089.
- The flaw allows unauthorized account takeover via a missing consent step.
- A patch is available in version 4.5.2 for immediate deployment.
Trigger.dev has released version 4.5.2 to address a high-severity cross-site request forgery vulnerability identified as CVE-2026-114089. This flaw exists in the Command Line Interface authorization flow for all versions prior to 4.5.2. The issue allows attackers to mint personal access tokens without user consent, leading to potential account compromise.
In plain English
The vulnerability stems from how the system handles authorization codes. When a user visits a specific URL containing an authorization code, the system automatically generates a personal access token. This process occurs without asking the user for permission or confirming their identity. Attackers can exploit this by luring logged-in users to these crafted links.
The background
According to the National Vulnerability Database record, the flaw is rated 8.7 on the Common Vulnerability Scoring System, placing it in the high severity category. It is classified under CWE-352, which covers cross-site request forgery weaknesses. The attack chain involves an attacker generating an unauthenticated code and directing a victim to a specific endpoint.
What changes now
Once the victim visits the malicious link while logged in, the system issues a token. The attacker then retrieves this token from an unauthenticated API endpoint. This grants the attacker full access to the victim's account. Version 4.5.2 is the first release that addresses this vulnerability.
Who needs to act first
Teams managing Trigger.dev installations should prioritize updating systems that are exposed to the internet. Before applying the patch, create a backup of the current configuration to allow for quick rollback if issues arise. Test the update in a non-production environment first to ensure compatibility with existing workflows. Verify that the authorization flow functions correctly after the upgrade.
Background: Cross-site request forgery (CSRF)
Cross-site request forgery tricks users into executing unwanted actions on trusted sites. Protect your business by enforcing same-site cookies and validating request origins. Verify that your web applications use anti-forgery tokens and restrict sensitive operations to secure contexts.
Read the full guide: CSRF Risks and Protection: Secure Your Business Web Apps
What to do and how to stay safe: Trigger.dev
- Update all instances of Trigger.dev to version 4.5.2 or later immediately.
- Review recent account activity for any unauthorized access or token generation.
- Monitor logs for suspicious requests to the authorization code endpoints.
- Educate users about the risks of clicking unknown links while logged in.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Trigger.dev are affected?
All versions of Trigger.dev prior to 4.5.2 are affected by this vulnerability.
Is there a confirmed fix available?
Yes, version 4.5.2 contains the patch for this vulnerability.
What is the severity of this flaw?
The National Vulnerability Database rates CVE-2026-114089 as high severity with a CVSS score of 8.7.
