{"id":"CVE-2026-114082","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-114082","generatedAt":"2026-10-28T06:35:40.797Z","title":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization.","description":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.","published":"2026-10-21T01:17:33.000Z","lastModified":"2026-10-22T18:17:28.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":7.2,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00335,"percentile":0.26757,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.00275,"percentile":0.18765}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T01:17:33.000Z","detail":{"score":"7.2","severity":"HIGH","publishedAt":"2026-10-21T01:17:32.660Z"},"summary":"New CVE, high severity (CVSS 7.2)."}],"references":[{"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-cpx8-cffg-mp4w","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/trigger-dev-before-4.6.2-overly-broad-realtime-session-stream-credentials","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114082","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}