Summary
Trigger.dev cli-v3 exposes its MCP server without requiring authentication, allowing nearby attackers or malicious web pages to reach tool endpoints.
If the server is reachable and the developer's stored access token is available to the process, an attacker may invoke actions such as starting or canceling runs and retrieving run logs.
Trigger.dev cli-v3 exposes its MCP server without requiring authentication, allowing nearby attackers or malicious web pages to reach tool endpoints.
If the server is reachable and the developer's stored access token is available to the process, an attacker may invoke actions such as starting or canceling runs and retrieving run logs.
Affected context
The issue affects Trigger.dev cli-v3 deployments in the affected version range when the trigger dev --mcp server is enabled and binds to all network interfaces. The exposed /sse and /messages endpoints may be reachable from the local network or through browser-driven requests, while the server can use the developer's stored access token for downstream Trigger.dev operations.
The issue affects Trigger.dev cli-v3 deployments in the affected version range when the trigger dev --mcp server is enabled and binds to all network interfaces. The exposed /sse and /messages endpoints may be reachable from the local network or through browser-driven requests, while the server can use the developer's stored access token for downstream Trigger.dev operations.
Exploit preconditions
- Attack surface: Network-accessible MCP server endpoints, including
/sseand/messages - Required access: Network proximity, or the ability to cause a developer's browser to send requests to the exposed service
- Trigger point: Submission of MCP
tools/callrequests - Required state: The MCP server must be running and able to access the developer's stored access token
- Why exploitation is possible: The server does not enforce authentication before processing MCP tool requests
- Attack surface: Network-accessible MCP server endpoints, including
/sseand/messages - Required access: Network proximity, or the ability to cause a developer's browser to send requests to the exposed service
- Trigger point: Submission of MCP
tools/callrequests - Required state: The MCP server must be running and able to access the developer's stored access token
- Why exploitation is possible: The server does not enforce authentication before processing MCP tool requests
Why this happens
The vulnerability results from exposing a network service without an authentication boundary. The MCP server accepts requests on interfaces reachable beyond the local host and processes tool calls without verifying that the caller is authorized.
This maps to CWE-306: Missing Authentication for Critical Function, because security-sensitive operations can be invoked without establishing the identity or authority of the requester.
The vulnerability results from exposing a network service without an authentication boundary. The MCP server accepts requests on interfaces reachable beyond the local host and processes tool calls without verifying that the caller is authorized.
This maps to CWE-306: Missing Authentication for Critical Function, because security-sensitive operations can be invoked without establishing the identity or authority of the requester.
Potential impact
- An attacker may invoke Trigger.dev task-management operations
- Active runs could be canceled or queried without authorization
- Run logs and other operational data could be disclosed
- The developer's stored access token could be used indirectly for unauthorized actions
- Workspace resources or workflows could be disrupted
- An attacker may invoke Trigger.dev task-management operations
- Active runs could be canceled or queried without authorization
- Run logs and other operational data could be disclosed
- The developer's stored access token could be used indirectly for unauthorized actions
- Workspace resources or workflows could be disrupted
General mitigation guidance
Mitigation generally focuses on ensuring that administrative or developer-only MCP services are not exposed without strong access controls.
Common defensive patterns include:
- Requiring explicit authentication and authorization for every MCP connection and tool call
- Binding development-only services to loopback by default rather than all network interfaces
- Restricting exposure with host-level firewall rules, network policies, or authenticated reverse proxies
- Using narrowly scoped, short-lived credentials where supported instead of broadly privileged stored tokens
- Applying least privilege to tokens and separating read-only operations from actions that change or cancel runs
- Disabling the MCP server when it is not required
Mitigation generally focuses on ensuring that administrative or developer-only MCP services are not exposed without strong access controls.
Common defensive patterns include:
- Requiring explicit authentication and authorization for every MCP connection and tool call
- Binding development-only services to loopback by default rather than all network interfaces
- Restricting exposure with host-level firewall rules, network policies, or authenticated reverse proxies
- Using narrowly scoped, short-lived credentials where supported instead of broadly privileged stored tokens
- Applying least privilege to tokens and separating read-only operations from actions that change or cancel runs
- Disabling the MCP server when it is not required
How teams detect issues like this
Organizations can look for:
- Static analysis and code review findings where HTTP or SSE handlers process requests without authentication middleware
- Network configuration that binds local development services to wildcard addresses
- Endpoint inventories containing unauthenticated
/sse,/messages, or MCP tool-call routes - Audit logs showing unexpected task invocation, run cancellation, or log retrieval
- Policy checks requiring authentication, authorization, and loopback binding for developer control-plane services
Automated security review tools can help identify missing authentication checks and unsafe network exposure patterns.
Organizations can look for:
- Static analysis and code review findings where HTTP or SSE handlers process requests without authentication middleware
- Network configuration that binds local development services to wildcard addresses
- Endpoint inventories containing unauthenticated
/sse,/messages, or MCP tool-call routes - Audit logs showing unexpected task invocation, run cancellation, or log retrieval
- Policy checks requiring authentication, authorization, and loopback binding for developer control-plane services
Automated security review tools can help identify missing authentication checks and unsafe network exposure patterns.
