Medium severity6.5NVD Advisory· Published Oct 21, 2026· Updated Oct 21, 2026

CVE-2026-114067

Description

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Triggerdotdev/trigger.devllm-fuzzy
Range: <4.6.2

Patches

Vulnerability mechanics

References

github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pc95-gc74-wg87nvd
www.vulncheck.com/advisories/trigger-dev-4.5.0-before-4.6.2-improper-authorization-via-snapshot-url-session-routenvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000