CVE-2026-114070 in Trigger.dev
Summary
by MITRE • 10/21/2026
Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
Trigger.dev versions prior to 4.6.0, specifically affecting releases starting from 4.5.0, contain a critical information disclosure vulnerability within its Dashboard Agent input proxy mechanism. This flaw stems from the improper handling of sensitive authentication credentials during the execution of agent workflows. The system is designed to facilitate interactions where an agent acts on behalf of a user, requiring the temporary delegation of authority through specific tokens. However, the implementation fails to adequately protect these delegated credentials when they are persisted for debugging or logging purposes within the application's session input records.
The technical root cause lies in the storage methodology employed by the Dashboard Agent input proxy. When an agent processes a request involving user-actor delegation, it generates a temporary token that grants limited permissions necessary to perform specific actions on behalf of the end-user. Instead of keeping this sensitive data strictly within memory or ephemeral session contexts where access is tightly controlled and transient, the system writes the full payload metadata into persistent storage accessible via standard API endpoints. Specifically, the field userActorToken containing the delegated credential is stored in plaintext within browser-readable session input records. This design decision exposes high-value authentication material to any entity that can interact with the logging or history retrieval mechanisms of the platform.
The operational impact of this vulnerability is severe due to the nature of the exposed data. An attacker who possesses a public session token associated with a chat interaction gains the ability to query the in records endpoint. By doing so, they can retrieve the stored payload metadata and extract the userActorToken. This extracted token is not merely informational; it serves as a valid credential for environment JWT exchange operations. Consequently, an adversary can replay this token to impersonate the legitimate user-actor within the Trigger.dev ecosystem. This effectively bypasses authentication controls intended to restrict access based on identity verification, allowing unauthorized execution of workflows and potential manipulation of data associated with that specific actor context.
From a classification perspective, this vulnerability aligns closely with CWE-200: Information Exposure, as it involves the unintended leakage of sensitive system information such as credentials or keys. Furthermore, in the context of the MITRE ATT&CK framework, this flaw facilitates Initial Access and Credential Access techniques. The ability to harvest valid tokens from logs or history records is a common tactic used by attackers to establish persistence or escalate privileges without needing to exploit additional software bugs for authentication bypasses directly.
Mitigation strategies must prioritize immediate remediation of the storage mechanism. Developers should ensure that sensitive fields like userActorToken are never written to persistent log files, database tables accessible via public APIs, or any browser-readable session data structures. If such tokens are required for debugging purposes, they must be cryptographically hashed using a strong one-way function before storage, ensuring that the original value cannot be recovered from the stored hash. Additionally, access controls on endpoints returning historical input records should be strictly enforced to ensure that only authorized administrative users with appropriate clearance can view detailed execution logs, and even then, sensitive fields should be masked or redacted by default. Updating Trigger.dev to version 4.6.0 or later is essential as this release addresses the underlying architectural flaw in how delegated tokens are managed during agent operations.