{"id":"GHSA-59h8-w5q6-mfmp","revision":"ba0b3e67b26d4e1a9092e744b2c75b0a","records":[{"revision":"ba0b3e67b26d4e1a9092e744b2c75b0a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-59h8-w5q6-mfmp","aliases":["CVE-2026-114086"],"title":"Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId","description":"## Summary\n\nThe POST handler for `/realtime/v1/streams/:runId/:streamId` has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream.\n\n## Vulnerability Details\n\n**File:** `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts`\n\nThe `action` handler (line 17) has no auth wrapper. The code comment says: \"Plain action for backwards compatibility with older clients that don't send auth headers.\"\n\nThe run lookup at line 29 uses `where: { friendlyId: runId }` with NO environment scoping (`runtimeEnvironmentId` is not checked), so production runs are accessible.\n\nRun friendlyIds follow predictable patterns (e.g., `run_1234abcd`).\n\n## Steps to Reproduce\n\n```bash\n# No authentication required\ncurl -X POST \"http://localhost:8030/realtime/v1/streams/run_KNOWN_ID/stream_1\"   -H \"Content-Type: application/json\"   -d '{\"injected\": \"data\"}'\n```\n\n## Impact\n\nUnauthenticated data injection into any run realtime stream. Cross-environment access (no scoping).","state":0,"publishedAt":"2026-10-02T22:39:57+00:00","modifiedAt":"2026-10-21T10:57:25.0581883+00:00","affected":[{"ecosystem":"npm","name":"trigger.dev","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.5.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-59h8-w5q6-mfmp","https://github.com/triggerdotdev/trigger.dev/pull/4250","https://github.com/triggerdotdev/trigger.dev/commit/73d966ad226548b5f96fb5b4fc6fa607a3b7b8f8","https://github.com/triggerdotdev/trigger.dev","https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.5"],"sourceUrl":"https://github.com/advisories/GHSA-59h8-w5q6-mfmp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-59h8-w5q6-mfmp","identifiers":["GHSA-59h8-w5q6-mfmp","CVE-2026-114086"]},"retained":false,"historicalAffected":[]}],"coverage":[]}