CVE-2026-114070

Name of the Vulnerable Software and Affected Versions Trigger.dev versions 4.5.0 through 4.5.x

Description An information disclosure issue exists in the Dashboard Agent input proxy. The system stores a delegated user-actor token within session input records that are accessible via the browser. An attacker possessing a public session token for a chat can access the records endpoint to retrieve the token from the payload.metadata.userActorToken variable and subsequently replay it to perform an environment JWT (JSON Web Token) exchange.

Recommendations Update Trigger.dev to version 4.6.0.