Trigger.dev CVE-2026-114068

Requires the attacker to possess any valid Trigger.dev secret API key (the CVSS PR:L reflects this low-privilege authenticated requirement) and to know or supply a target run ID belonging to another organization. The flaw is in the waitpoint token wait endpoint, which is reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). No special non-default configuration is named in the advisory, so default multi-tenant deployments of Trigger.dev prior to 4.6.0 are affected. Limiting factors: the attacker is not fully unauthenticated - a provisioned secret API key is mandatory - and the practical blast radius is largest on shared/multi-tenant instances where keys from one organization can reference another organization's run IDs.

This is a moderate, practically-relevant authorization flaw (CWE-639, IDOR-class) rather than a critical infrastructure break. The source CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H) scores 7.2 and is internally consistent with the description: network-reachable endpoint, low complexity, and low privilege (PR:L) matching the stated requirement of holding 'any secret API key.' The primary impact is availability (victim runs blocked indefinitely, VA:H) and integrity (injected resume data, VI:H), with only limited confidentiality exposure (VC:L). No EPSS score, KEV listing, or POC was supplied: exploitation status is 'no public exploit identified at time of analysis,' so there is no evidence of active or widespread exploitation. The chief risk-amplifying factor is the cross-tenant nature - a single valid API key from any organization can disrupt other organizations' runs on a shared/multi-tenant Trigger.dev instance - which makes this meaningful for hosted or shared deployments. Net: a genuine, patch-worthy priority for multi-tenant Trigger.dev operators, but not an emergency-grade remote code execution; raw CVSS slightly overstates urgency given the authenticated prerequisite and absence of exploitation signals. Note: EPSS and POC data are entirely absent from the input and could not be weighed.

An attacker who has signed up for (or obtained) any valid Trigger.dev secret API key calls the waitpoint token wait endpoint, supplying a run ID belonging to a different organization together with their own waitpoint. The victim's run is then blocked on a waitpoint that only the attacker controls and the victim cannot complete, stalling it indefinitely, and the attacker can inject arbitrary resume data into it. No public exploit code is identified at time of analysis, and the authenticated, low-complexity network vector (PR:L/AC:L) makes the attack straightforward to script once a key is held.