{"id":"CVE-2026-114086","aliases":["GHSA-59h8-w5q6-mfmp"],"url":"https://o3.security/vulnerability/CVE-2026-114086","summary":"Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint","details":"## Summary\n\nThe POST handler for `/realtime/v1/streams/:runId/:streamId` has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream.\n\n## Vulnerability Details\n\n**File:** `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts`\n\nThe `action` handler (line 17) has no auth wrapper. The code comment says: \"Plain action for backwards compatibility with older clients that don't send auth headers.\"\n\nThe run lookup at line 29 uses `where: { friendlyId: runId }` with NO environment scoping (`runtimeEnvironmentId` is not checked), so production runs are accessible.\n\nRun friendlyIds follow predictable patterns (e.g., `run_1234abcd`).\n\n## Steps to Reproduce\n\n```bash\n# No authentication required\ncurl -X POST \"http://localhost:8030/realtime/v1/streams/run_KNOWN_ID/stream_1\"   -H \"Content-Type: application/json\"   -d '{\"injected\": \"data\"}'\n```\n\n## Impact\n\nUnauthenticated data injection into any run realtime stream. Cross-environment access (no scoping).","published":"2026-10-21T00:36:52.744Z","modified":"2026-10-21T10:46:23.216493877Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"trigger.dev","fixedVersion":"4.5.5"}],"fix":{"url":"https://github.com/triggerdotdev/trigger.dev/pull/4250","label":"triggerdotdev/trigger.dev#4250"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114086.json"},{"type":"ADVISORY","url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-59h8-w5q6-mfmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114086"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/trigger-dev-before-4.5.5-unauthenticated-realtime-stream-data-injection-via-streams-endpoint"},{"type":"WEB","url":"https://github.com/triggerdotdev/trigger.dev/pull/4250"},{"type":"WEB","url":"https://github.com/triggerdotdev/trigger.dev/commit/73d966ad226548b5f96fb5b4fc6fa607a3b7b8f8"},{"type":"PACKAGE","url":"https://github.com/triggerdotdev/trigger.dev"},{"type":"WEB","url":"https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T10:46:23.216493877Z"}}