CVE-2026-114090: Missing Authentication for Critical Function in trigger.dev cli-v3

CVE-2026-114090 describes a missing authentication vulnerability in trigger.dev cli-v3 versions >=3.0.0 and <4.5.4. The vulnerability exists in the trigger dev --mcp server component, which listens on all network interfaces and exposes endpoints (/sse and /messages) that can be accessed without proper authentication. This allows attackers on the local network or malicious web pages to perform actions including invoking trigger-task, cancel-run, listing runs, and retrieving run logs by leveraging the developer's stored access token.

An attacker with LAN access or control over a malicious web page can exploit this vulnerability to perform critical functions on the trigger.dev cli-v3 without proper authentication. This includes triggering tasks, cancelling runs, listing runs, and accessing run logs, potentially leading to unauthorized control or disclosure of sensitive operational data. The CVSS 4.0 score is 7.6 (high severity), reflecting the significant impact on confidentiality and integrity with low attack complexity but requiring attacker presence on the local network or via malicious web content.

A fixed version is available starting from 4.5.4 that addresses this missing authentication vulnerability. Users should upgrade to version 4.5.4 or later to remediate this issue. Since this is not a cloud service, remediation requires updating the affected software. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.