# CVE-2026-114090: Trigger.dev cli-v3 missing authentication in MCP server

Source: https://junglewise.ai/threats/cve-2026-114090-trigger-dev-cli-v3-from-3-0-0-before-4-5-4-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114090 · Severity: high · CVSS 7.1 · Published 2026-10-21

Trigger.dev's command-line tool for local MCP server operations fails to authenticate incoming requests, exposing developer credentials and project data. An attacker on the same network or through a malicious webpage can invoke task operations, cancel runs, and access logs using the developer's stored API token, leading to unauthorized task execution and data exposure.

Vendors: [Trigger.dev](https://junglewise.ai/threats/vendors/trigger-dev).

## Quick answers

**Is CVE-2026-114090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114090 being exploited in the wild.

**How severe is CVE-2026-114090?** High severity, with a CVSS score of 7.1, published 21 October 2026.

**Which products and versions are affected?** Trigger.dev Cli-V3 3.0.0 before 4.5.4.

**Is there a fix for CVE-2026-114090?** Yes: fixed in 4.5.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114090 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-114090?** Check whether you run Trigger.dev Cli-V3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.4

## Technical details

The MCP server launched by `trigger dev --mcp` binds to all network interfaces (0.0.0.0) without hostname restriction and exposes /sse and /messages endpoints with no authentication middleware. An attacker on the LAN or a malicious webpage visited by the developer can send JSON-RPC 2.0 MCP tool requests to invoke trigger-task, cancel-run, list-runs, and get-run-logs, all of which execute against the developer's stored Trigger.dev access token bound at server construction.

## Affected products

- Trigger.dev cli-v3 3.0.0 before 4.5.4

## Timeline

- 2026-07-21: disclosed
- 2026-10-20: advisory

## References

- [https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqmg-rq46-vm4m](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqmg-rq46-vm4m)
- [https://www.vulncheck.com/advisories/trigger-dev-cli-3.0.0-before-4.5.4-missing-authentication-in-mcp-server](https://www.vulncheck.com/advisories/trigger-dev-cli-3.0.0-before-4.5.4-missing-authentication-in-mcp-server)