[CVE-2026-114090] Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the tr…

Descripción técnica

Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token.

Puntuación CVSS

Score: 7.1/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Debilidades (CWE)

CWE-306

Fuente oficial

Publicado en NIST NVD.