MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-114067
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-22T22:14:18.200859+00:00
- Epss score
- 0.00221
- Cvss score
- 6.5
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-10-22T22:17:33+00:00
- Score
- 6.5
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-114067
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- First seen by Signal
- 2026-10-21T22:34:38+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Published at
- 2026-10-21T01:17:30.250
- Last modified
- 2026-10-22T18:17:27.520
- Epss percentile
- 0.11933
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph