Trigger.dev Cross-tenant Path Traversal & Auth Bypass via URL Normalization (CVE-2026-73558)

Vulnerability Overview Vulnerability Name: Cross-tenant object store read and write via URL path traversal CVE ID: CVE-2026-73558 Severity: High (8.2 / 10) Release Date: Jul 9 Reporter: carderner TL;DR: Any user with a Trigger.dev API key can read and overwrite task payloads in the object store belonging to any other tenant. One cURL request hits any S3-compatible storage (including Cloudflare R2, MinIO, S3 with Static Storage) that is used by managed cloud and most self-hosted instances. Scope Affected Versions: >= 4.4.2, = 4.5.0 Vulnerability Details 1. Path Traversal via URL Path Normalization in Signed Client (CWE-22, Critical) - In the and methods, is set to , causing the WHATWG pathname algorithm to fold segments before the signature is generated. This allows the signed URL to escape the tenant prefix. 2. User-Controlled Wildcards Connected to S3 Keys Without Validation (CWE-20, High) - In and , is directly concatenated into the and of without rejecting or percent-encoded variants. 3. Missing Resource-Based Authorization in GET Loader (CWE-862, High) - In , the asynchronous function always returns a truthy value. Consequently, the auth layer checks "this is a valid JWT" but never checks "this key belongs to this env." A JWT issued for Env A can read payloads from Env B. Exploitation Chain / PoC Cross-Tenant Read Cross-Tenant Write (Payload Injection into Victim's Execution) Remediation Vuln 1: In and , stop assigning to . Encode each segment and append it, or reject keys containing , , , before signing. Vuln 2: Validate in both routes using the regular expression and reject segments containing . Vuln 3: Replace the asynchronous function with a proper check that ensures the requested key falls under the prefix of the authenticated env.

Goal Reached Thanks to every supporter — we hit 100%!

Trigger.dev Cross-tenant Path Traversal & Auth Bypass via URL Normalization (CVE-2026-73558)

More from this source