CVE-2026-114070: Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Q: Who can exploit this issue?

An attacker must possess a chat's public session token and be able to access the session records endpoint. They can then obtain the delegated user-actor token from payload.metadata.userActorToken.

Q: What can an attacker do with the disclosed token?

The recovered delegated user-actor token can be replayed for an environment JWT exchange. The provided data identifies information disclosure impact and does not describe integrity or availability impact.

Q: Which versions are affected?

Trigger.dev 4.5.0 is affected, while the issue is addressed in 4.6.0. The provided version range describes versions before 4.6.0.

Published Oct 21, 2026

Updated

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.

Affected Software

1 affected component

Trigger.dev Trigger.dev>=4.5.0<4.6.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must possess a chat's public session token and be able to access the session records endpoint. They can then obtain the delegated user-actor token from payload.metadata.userActorToken.

What can an attacker do with the disclosed token?

The recovered delegated user-actor token can be replayed for an environment JWT exchange. The provided data identifies information disclosure impact and does not describe integrity or availability impact.

Which versions are affected?

Trigger.dev 4.5.0 is affected, while the issue is addressed in 4.6.0. The provided version range describes versions before 4.6.0.

CVE-2026-114070: Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with the disclosed token?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker do with the disclosed token?

Which versions are affected?