Patch Trigger.dev CLI CSRF Flaw Before Version 4.5.2 to Prevent Account Takeover

Security teams should ensure Trigger.dev installations are at version 4.5.2 or later. The NVD record indicates that versions before 4.5.2 contain a cross-site request forgery vulnerability in the command-line interface authorization flow. This flaw exposes users to account takeover if they visit a malicious link while authenticated.

The risk

The vulnerability stems from how the CLI handles authorization codes. According to the NVD record, loading the endpoint /account/authorization-code/<code> mints a Personal Access Token without any consent step. This bypasses standard security controls that should verify user intent before issuing sensitive credentials.

An attacker can exploit this by generating an unauthenticated code and tricking a logged-in user into visiting the corresponding URL. Once the victim loads the page, the system issues a token. The attacker can then retrieve this token from the unauthenticated /api/v1/token endpoint to take over the account.

Who is exposed

Any organization or developer using Trigger.dev CLI versions earlier than 4.5.2 is exposed to this risk. The vulnerability affects the authorization-code flow specifically, meaning users who have authenticated via the CLI are potential targets. Since the exploit requires the victim to be logged in and to visit a specific URL, it relies on social engineering or phishing tactics to initiate.

The impact is significant because the stolen Personal Access Token allows the attacker to take over the user's account. This grants the attacker control over the account associated with the token.

Cost and compliance

The National Vulnerability Database rates CVE-2026-114089 as having a CVSS score of 8.7, which falls into the High severity category. The weakness is categorized under CWE-352, which relates to cross-site request forgery. Organizations with strict compliance requirements for access control and authentication may need to document the remediation of this flaw to maintain their security posture.

Our take on the response

Upgrading to version 4.5.2 is the primary mitigation step. Teams should also review recent CLI authorization events for anomalies, such as unexpected token generation or access from unfamiliar IP addresses. That suggests a need for heightened monitoring of authentication endpoints until all instances are patched.

What defenders should look for

Security operations teams should monitor for unusual authentication patterns, such as multiple rapid authorization requests from a single user or unexpected token issuance. Check logs for access to the /account/authorization-code endpoint followed immediately by requests to /api/v1/token from different IP addresses. Look for alerts indicating new personal access tokens being created without corresponding user-initiated actions. Contain potential compromises by revoking suspicious tokens and forcing re-authentication for affected accounts.

Background: Account takeover

Account takeover protection stops attackers from using stolen credentials by verifying identity through multiple factors and monitoring login patterns. You secure accounts by enforcing multi-factor authentication, checking for impossible travel, and validating device fingerprints to ensure the person logging in matches the expected user profile.

Read the full guide: Account Takeover Protection: Mechanisms, Trade-offs, and Defense

What to do and how to stay safe: Trigger.dev

• Update all Trigger.dev CLI installations to version 4.5.2 or later to eliminate the vulnerability.
• Audit recent Personal Access Token creation logs for any tokens generated without explicit user consent.
• Revoke any Personal Access Tokens that appear suspicious or were created during the window of exposure.
• Educate users to avoid clicking on unsolicited links that may lead to the authorization-code endpoint.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-114089?

The CVSS score is 8.7, which is classified as High severity.

Which versions of Trigger.dev are affected by this vulnerability?

All versions of Trigger.dev before 4.5.2 are affected by this cross-site request forgery flaw.

How does an attacker exploit this vulnerability?

Attackers lure a logged-in user to a specific URL that mints a token, then retrieve that token from an unauthenticated endpoint.