All vulnerabilities
GHSA-59h8-w5q6-mfmpCVE-2026-114086

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

trigger.devnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.5.5Fixed versionGitHub
Published2 Oct 2026Updated 21 Oct 2026GitHub

What fixes it

  • 4.5.5trigger.dev, npmGitHubnpm install trigger.dev@4.5.5

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

The POST handler for /realtime/v1/streams/:runId/:streamId has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream.

Vulnerability Details

File: apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts

The action handler (line 17) has no auth wrapper. The code comment says: "Plain action for backwards compatibility with older clients that don't send auth headers."

The run lookup at line 29 uses where: { friendlyId: runId } with NO environment scoping (runtimeEnvironmentId is not checked), so production runs are accessible.

Run friendlyIds follow predictable patterns (e.g., run_1234abcd).

Steps to Reproduce

# No authentication required
curl -X POST "http://localhost:8030/realtime/v1/streams/run_KNOWN_ID/stream_1"   -H "Content-Type: application/json"   -d '{"injected": "data"}'

Impact

Unauthenticated data injection into any run realtime stream. Cross-environment access (no scoping).

Text from GitHub Advisory Database

Affected versions 2

  • trigger.dev, npm<= 4.5.4GitHub
  • trigger.dev, npmfrom first release, fixed in 4.5.5OSV

References 5