REPORTED DEVELOPMENT
CVE publication window: 21-22 October; original disclosure predates it.
CVE-2026-114090, CVSS 7.6 High, affects the MCP server started by Trigger.dev's development command. A caller able to reach the interface could invoke tools using process-held credentials, potentially accessing runs, tasks and logs. Version 4.5.4 fixes it. Original disclosure occurred before the 21-22 October CVE publication.
WHY IT MATTERS TO THE MARKET
MCP-call authentication and effective process privileges matter even in development environments.