CVE-2026-114086

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.5

Description Missing authentication in the realtime streams POST handler allows unauthenticated attackers to inject arbitrary data into run streams across any environment, including production. This occurs because the action handler in the file apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts lacks an authentication wrapper. Furthermore, the system performs run lookups using the friendlyId variable without verifying the runtimeEnvironmentId, and these identifiers follow predictable patterns. The affected API endpoint is '/realtime/v1/streams/:runId/:streamId'.

Recommendations Update to version 4.5.5 or later.