Trigger.dev's trigger dev --mcp server let anyone on the network or a web page use the developer's token

CVE-2026-114090 was published October 21, 2026 (UTC), which was October 20 in Pacific time. The NVD record, from the CNA VulnCheck, says Trigger.dev cli-v3 from 3.0.0 before 4.5.4 has a missing authentication flaw in the trigger dev --mcp server. The server binds all network interfaces and exposes its /sse and /messages endpoints, so attackers on the local network, or malicious web pages, can send MCP tools/call requests that invoke trigger-task, cancel-run, list-runs, and get-run-logs using the developer's stored access token. The record names CWE-306 and rates it CVSS 3.1 7.1 High and CVSS 4.0 7.6 High.

Trigger.dev's advisory, GHSA-pqmg-rq46-vm4m, was published July 21, 2026 and rates it High. It says the server was started with a port and no host, so Node listened on every interface (port 3333 by default), and neither route checked a token or the request's origin. The developer's Trigger.dev access token was bound when the server started, so any caller that reached /messages acted as the developer. A web page the developer visits can open the server-sent events stream on localhost and then post tool calls to it. The advisory says trigger-task queues a real run in the developer's project, and that run lists and logs often contain payloads, user input, and secrets.

The advisory lists the affected range as 3.0.0 and later, patched in 4.5.4. The 4.5.4 release of the CLI (the trigger.dev npm package) removed the --mcp and --mcp-port options from trigger dev, and the MCP server now runs through the separate trigger mcp command. You were only exposed while trigger dev --mcp was running.