Critical Authentication Bypass in Redis - CVE-2026-114087

Trigger.dev self-hosted and cloud deployments through version 4.7.6 expose a supervisor workload API endpoint (attempts/start) that performs no ownership check, letting a caller act on runs and snapshots belonging to other deployments. Exploitation is not anonymous: an attacker must already hold a legitimate low-privilege run/snapshot pair and must reach the supervisor over an adjacent network segment, after which they can read resolved environment variables and run JWTs or start, complete, and suspend other tenants' runs. There is no public exploit code or confirmed active exploitation (no CISA KEV), and the vendor advisory GHSA-jc26-22qp-cgqj is the authoritative reference; risk concentrates in multi-tenant or hosted installations where untrusted workloads share a supervisor, while single-tenant self-hosted setups with no third-party workloads are materially less exposed.

Cross-site request forgery in Trigger.dev before 4.5.2 lets an attacker mint a Personal Access Token for a logged-in victim and then collect it from the unauthenticated /api/v1/token endpoint, resulting in full account takeover. The flaw affects Trigger.dev deployments running versions prior to 4.5.2 and requires only that the victim have an active authenticated session and be lured into opening a crafted /account/authorization-code/<code> URL. No public exploit identified at time of analysis; the vendor advisory GHSA-58mc-m3qq-6qrh and the VulnCheck advisory provide further detail, and upgrading to 4.5.2 addresses the vulnerable flow.

Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach.

Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.

SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis.

Trigger.dev's dashboard run replay endpoint lets an attacker who knows or enumerates a run friendlyId replay another organization's task run into an environment of the attacker's choosing, potentially exposing task payloads and executing the task with the victim's secrets. The vendor CVSS 4.0 score is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N), with an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; the CVSS PR:N designation suggests unauthenticated access, although the GHSA's 'any authenticated user' wording means authentication requirements are not definitively confirmed. Publicly available exploit code exists (a PoC POST request is included in the GHSA), but no CISA KEV entry or confirmed active exploitation appears in the supplied data.

Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.

Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6.