Trigger.dev CLI v3 (versions 3.0.0 through 4.5.3) has a missing authentication flaw in its --mcp server. The server exposes the /sse and /messages endpoints on all network interfaces without validating the caller, allowing attackers who can reach the server to send MCP tool calls that trigger tasks, cancel runs, list pending runs, or retrieve run logs by using a developer's stored access token. This authentication bypass (CWE‑306) gives unauthorized users control over scheduled jobs and read access to execution logs, potentially causing data exposure and operational disruption.

Vendor trigger.dev, product trigger.dev CLI v3, releases 3.0.0 through 4.5.3 are affected. The MCP server binds to all network interfaces, making its endpoints reachable on the local network. The vulnerability was fixed in version 4.5.4 and later, which reintroduces proper authentication for the MCP server.

The base CVSS score of 7.6 indicates high potential damage if exploited. The EPSS score of < 1% reflects a currently low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers are most likely to exploit this weakness from within the same local network or by loading a malicious web page that can send MCP requests. Because the flaw is an authentication bypass, any user who can reach the MCP server endpoint can perform the described actions without further credentials, making the vulnerability exploitable as long as the server is exposed.