What happened
Verified via NVD REST (published 2026-10-21): missing authentication (CWE-306) in the MCP server launched by trigger dev --mcp; the endpoints are exposed on all interfaces with no auth check, letting any LAN attacker or malicious web page invoke the five task-management tools against the developer's account. Two further Trigger.dev issues in the same wave: PUT snapshot-url authorization (CVE-2026-114067) and Dashboard Agent input-proxy token disclosure (CVE-2026-114070).
Why it matters
AI-agent dev servers with MCP surfaces are increasingly reverse-proxied or run on shared networks; an unauthenticated MCP endpoint turns every LAN peer into a remote operator of the developer's agent pipeline and consumes their cloud token — a realistic developer-tooling agent attack surface.
Attack vector
Unauthenticated MCP tools/call requests to the dev server's /sse and /messages endpoints invoke trigger-task, cancel-run, list-runs and get-run-logs using the developer's stored Trigger.dev access token — no credentials required, reachable from the LAN or from a browser via CSRF-style requests to the loopback-bound-but-all-interfaces server.
Affected systems
@trigger.dev/cli-v3 3.0.0 – <4.5.4 (fixed 4.5.4)
Mitigation
Upgrade @trigger.dev/cli-v3 to 4.5.4+; do not run the dev MCP server on untrusted networks; bind to loopback only where possible. Advisory: GHSA-pqmg-rq46-vm4m / VulnCheck advisory.