CVE-2026-114075: Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Q: Who can exploit this issue?

An attacker needs a capability-restricted user-actor token (UAT) with read-only access. They can use that token to send a POST request to the project's alertChannels endpoint.

Q: What impact can exploitation have?

An attacker can create production webhook alert channels pointing to infrastructure they control. Future deployment and error alerts can then be routed to that attacker-controlled destination.

Q: Which deployments are affected?

Trigger.dev versions before 4.5.12 are affected. The provided information does not state whether any particular default token or alert-channel configuration is required beyond possession of a read-only UAT.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert channels by using the legacy personal access token helper. Attackers with a read-only UAT can POST to the project alertChannels endpoint to create production webhook channels, routing future deployment and error alerts to attacker-controlled infrastructure.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev to a version that resolves this vulnerability.
Fixed in 4.5.12

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a capability-restricted user-actor token (UAT) with read-only access. They can use that token to send a POST request to the project's alertChannels endpoint.

What impact can exploitation have?

An attacker can create production webhook alert channels pointing to infrastructure they control. Future deployment and error alerts can then be routed to that attacker-controlled destination.

Which deployments are affected?

Trigger.dev versions before 4.5.12 are affected. The provided information does not state whether any particular default token or alert-channel configuration is required beyond possession of a read-only UAT.

CVE-2026-114075: Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can exploitation have?

Which deployments are affected?