CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5.

• CWE-20
• CWE-22
• CWE-862

• https://github.com/triggerdotdev/trigger.dev/commit/db4074df54db06b0656becf3f974345c90fa202e
• https://github.com/triggerdotdev/trigger.dev/pull/3830
• https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.0-rc.5
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-888c-px7m-736v
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-888c-px7m-736v

Published

Aug 13, 2026

Last Modified

Aug 14, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73652vantage6 is an open-source infrastructure for privacy preser…7.1
• CVE-2026-73653Vitest is a testing framework powered by Vite. Prior to vers…9.4
• CVE-2026-73654Trigger.dev is a platform for building and deploying fully m…8.5
• CVE-2026-73655Trigger.dev is a platform for building and deploying fully m…7.4
• CVE-2026-73656Trigger.dev is a platform for building and deploying fully m…9.9
• CVE-2026-73657Trigger.dev is a platform for building and deploying fully m…4.2
• CVE-2026-73659Trigger.dev is the open-source platform for building AI work…8.1
• CVE-2026-7366IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM Data…4.2
• CVE-2026-73660FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5…7.5
• CVE-2026-73661FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.…8.6
• CVE-2026-73662FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, …7.6
• CVE-2026-73663FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 …9.3