01 Record

CVE-2026-73658

Trigger.dev: Cross-tenant object store read and write via URL path traversal

HighPUBLISHEDCNA: GitHub_M

Base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

02 Description

Trigger.dev: Cross-tenant object store read and write via URL path traversal

Published: 2026-08-13 21:16Z21 HR AGO
Last updated: 2026-08-14 16:30Z2 HR AGO
Reserved: 2026-08-13
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 8.2)
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses: CWE-20 CWE-22 CWE-862
SSVC decision: ExploitationpocAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 80dd03d8274c5bc8ac3a72e375f1e44656d1139b7200c6c84adeaf41dab89da9

VendorProductVersionsPlatforms

triggerdotdevtrigger.dev>= 4.4.2, < 4.5.0-rc.5—