Key points
- Trigger.dev versions prior to 4.5.0-rc.3 are affected by CVE-2026-114083.
- The flaw allows authenticated tenants to read or overwrite other tenants' run payloads.
- No patch has been confirmed yet for versions earlier than 4.5.0-rc.3.
Trigger.dev versions before 4.5.0-rc.3 contain a high-severity path traversal vulnerability identified as CVE-2026-114083. According to the National Vulnerability Database, this flaw allows authenticated tenants to escape their designated object key prefix. Attackers can use unsanitized filename segments to access data belonging to other tenants on the platform.
In plain English
The vulnerability exists in the api/v1/packets and api/v2/packets endpoints. An attacker with a single valid API key can inject sequences like "../" into requests. This tricks the system into generating presigned URLs for GET or PUT operations. These URLs allow the attacker to read or overwrite run payloads and outputs from other tenants.
The background
The issue is rated 8.6 on the Common Vulnerability Scoring System, which classifies it as high severity. It is categorized under CWE-22, indicating a failure to properly neutralize special elements in file paths. This type of flaw typically arises when software does not sufficiently validate user-supplied input before using it to construct file system paths.
What changes now
Users running Trigger.dev versions earlier than 4.5.0-rc.3 are exposed to this risk. The vendor has not released a confirmed fix for older stable releases in the source material. Organizations must determine if they are using affected versions and assess their exposure to cross-tenant data leakage.
Who needs to act first
Teams should prioritize updating systems that host multiple tenants or sensitive data. Check whether your current version is earlier than 4.5.0-rc.3. If a fix becomes available, test it in a non-production environment first. Back up your configuration before applying any updates. Monitor logs for unusual access patterns to the packet endpoints while no fix is confirmed.
What to do and how to stay safe: Trigger.dev
- Verify your Trigger.dev version immediately to see if it is before 4.5.0-rc.3.
- Restrict API key permissions to the minimum necessary scope for each tenant.
- Monitor access logs for attempts to use directory traversal sequences in requests.
- Isolate tenant data in separate storage buckets if possible to limit blast radius.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Trigger.dev are affected by CVE-2026-114083?
All versions of Trigger.dev before 4.5.0-rc.3 are affected by this path traversal vulnerability.
Can an attacker use this flaw without logging in?
No, the attacker must hold one valid API key to exploit this authenticated vulnerability.
What can an attacker do with this flaw?
Attackers can read or overwrite other tenants' run payloads and outputs using presigned URLs.
