CLEANSTART-2026-XE23259 Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

Security vulnerability affects the nodejs-24 package. Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons...

EUVD-2026-106892

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...

CVE-2026-114089

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...

CVE-2026-114089 Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...

CVE-2026-114089

Trigger.dev versions prior to 4.5.2 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the CLI authorization-code flow. The root cause is that accessing the /account/authorization-code/

CVE-2026-114082

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082

Versions of Trigger.dev before 4.6.2 are susceptible to an authorization vulnerability involving overly broad realtime session stream credentials . Public-token holders with session write access can obtain environment-wide S2 stream credentials through session input initialization. This allows an...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114082 Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

EUVD-2026-106885

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-114079

The software Trigger.dev versions prior to 4.5.6 is vulnerable to an improper authorization flaw (CWE-639). The issue exists because the DeploymentService.getDeployment scopes perform lookups based solely on projectId, failing to restrict actions by environment trust levels. Consequently, an atta...

EUVD-2026-106882

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

CVE-2026-114079 Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

CVE-2026-114078 Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's...

CVE-2026-114078

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's...

EUVD-2026-107029

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's...

CVE-2026-114079

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can...

CVE-2026-114078

Trigger.dev versions before 4.5.6 are vulnerable to an authorization bypass within the DeleteTaskScheduleService and SetActiveOnTaskScheduleService components. The root cause is an unscoped friendlyId lookup , which allows authenticated users to delete or disable IMPERATIVE cron schedules belongi...

CVE-2026-114077 Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...

EUVD-2026-107028

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...