Security Advisories · triggerdotdev/trigger.dev · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

V1 coordinator default-secret unauth Socket.IO
GHSA-gg6r-gp4c-89hp published Jul 20, 2026 by carderne

Moderate
Cross-tenant payload poisoning via packet write + replay
GHSA-jx48-qfwm-xq67 published Jul 9, 2026 by carderne

Moderate
Cross-tenant object store read and write via URL path traversal
GHSA-888c-px7m-736v published Jul 9, 2026 by carderne

High
CLI auth-code phishing → PAT takeover and org destruction
GHSA-58mc-m3qq-6qrh published Jul 9, 2026 by carderne

Critical
trigger dev --mcp MCP server binds default network interface and exposes /sse + /messages without authentication, allowing reachable callers to invoke MCP tools that operate against the developer's stored Trigger.dev access token
GHSA-pqmg-rq46-vm4m published Jul 21, 2026 by carderne

High
Cross-tenant task replay via missing authorization in replay endpoints
GHSA-9fq3-68cw-r7p2 published Jul 9, 2026 by carderne

High
Account Takeover via Cross-Provider OAuth Email Matching in Google Login
GHSA-rp8c-h4xr-w9qv published Jul 9, 2026 by carderne

High
Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
GHSA-pp95-gc86-jq6q published Jul 9, 2026 by carderne

High
CSRF Logout
GHSA-2cqj-rq4j-8835 published Jul 21, 2026 by carderne

Moderate