CVE-2026-73658: Trigger.dev: Cross-tenant object store read and write via URL path traversal
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params[""] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trigger.devto a version that resolves this vulnerability.Fixed in 4.5.0-rc.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73658?
CVE-2026-73658 has a severity rating of 8.2, categorizing it as high risk.
How do I fix CVE-2026-73658?
To address CVE-2026-73658, you should update to Trigger.dev version 4.5.0 or later.
What type of vulnerability is CVE-2026-73658?
CVE-2026-73658 is a cross-tenant object store read and write vulnerability caused by path traversal.
What components are affected by CVE-2026-73658?
CVE-2026-73658 affects the Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() functionalities in Trigger.dev.
What impact does CVE-2026-73658 have on users?
CVE-2026-73658 can allow unauthorized access to app data due to user-controlled URL pathname manipulation.