CVE-2026-114086: Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Q: Which deployments are exposed?

Any Trigger.dev deployment running a version before 4.5.5 is affected. The vulnerable endpoint can be used to inject data into realtime streams in any environment, including production.

Q: What does an attacker need to exploit this issue?

An attacker does not need authentication, privileges, or user interaction. They need to send a POST request to the realtime streams endpoint using a predictable run friendlyId.

Q: What is the immediate remediation?

Upgrade Trigger.dev to version 4.5.5 or later. The issue affects versions before 4.5.5.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to inject arbitrary data into any environment's realtime stream, including production.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Any Trigger.dev deployment running a version before 4.5.5 is affected. The vulnerable endpoint can be used to inject data into realtime streams in any environment, including production.

What does an attacker need to exploit this issue?

An attacker does not need authentication, privileges, or user interaction. They need to send a POST request to the realtime streams endpoint using a predictable run friendlyId.

What is the immediate remediation?

Upgrade Trigger.dev to version 4.5.5 or later. The issue affects versions before 4.5.5.

CVE-2026-114086: Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the immediate remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the immediate remediation?