CVE-2026-114090: Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

Q: Which deployments are exposed?

Trigger.dev CLI v3 installations from 3.0.0 through versions before 4.5.4 are affected when running the `trigger dev --mcp` server. The server binds to all network interfaces, exposing its MCP endpoints to the local network rather than only the local host.

Q: What does an attacker need to exploit this issue?

An attacker needs network access to the exposed MCP server, such as being on the same LAN. A malicious web page can also send MCP tool-call requests to the server.

Q: What could an unauthenticated attacker do?

Requests to the exposed endpoints can invoke `trigger-task`, `cancel-run`, `list-runs`, and `get-run-logs`. These actions use the developer's stored access token, potentially exposing run information and allowing task invocation or cancellation.

Q: How can I determine whether an instance is affected?

Check whether the installed Trigger.dev CLI is v3 version 3.0.0 or later but earlier than 4.5.4, and whether `trigger dev --mcp` is running. An affected server exposes the `/sse` and `/messages` endpoints on all network interfaces.

Published Oct 21, 2026

Updated

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

Affected Software

1 affected component

Trigger.dev CLI>=3.0.0<4.5.4

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Trigger.dev CLI v3 installations from 3.0.0 through versions before 4.5.4 are affected when running the `trigger dev --mcp` server. The server binds to all network interfaces, exposing its MCP endpoints to the local network rather than only the local host.

What does an attacker need to exploit this issue?

An attacker needs network access to the exposed MCP server, such as being on the same LAN. A malicious web page can also send MCP tool-call requests to the server.

What could an unauthenticated attacker do?

Requests to the exposed endpoints can invoke `trigger-task`, `cancel-run`, `list-runs`, and `get-run-logs`. These actions use the developer's stored access token, potentially exposing run information and allowing task invocation or cancellation.

How can I determine whether an instance is affected?

Check whether the installed Trigger.dev CLI is v3 version 3.0.0 or later but earlier than 4.5.4, and whether `trigger dev --mcp` is running. An affected server exposes the `/sse` and `/messages` endpoints on all network interfaces.

CVE-2026-114090: Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an unauthenticated attacker do?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What could an unauthenticated attacker do?

How can I determine whether an instance is affected?