Trigger.dev CVE-2026-114084

Requires an authenticated caller presenting any project API key scoped with read:runs; privilege level is low but non-zero (PR:L). The flaw is reachable via the /realtime/v1/runs endpoint by supplying a tags query parameter containing injected SQL, exploiting the unescaped concatenation into the ElectricSQL shape where clause. Impact is meaningful only on self-hosted instances hosting multiple organizations/tenants - a single-tenant or SaaS-isolated deployment yields no cross-organization data because there is no foreign tenant data colocated. Limiting factors: a valid read:runs API key is mandatory (not unauthenticated), the instance must be self-hosted and multi-tenant, and only versions before 4.5.6 are affected.

This is a credible priority for operators of multi-tenant self-hosted Trigger.dev deployments, not merely a high-CVSS paper risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.3) indicates network-reachable, low-complexity exploitation requiring only low privilege (PR:L), with high confidentiality impact to both the vulnerable system (VC:H) and subsequent systems (SC:H) - the latter reflecting the cross-tenant data exposure where one tenant reads every other organization's data. The real-world weight of this is high because the authentication barrier is weak: any project API key with the read:runs scope suffices, so a single legitimate low-tier tenant on a shared instance can read all tenants' TaskRun payloads and metadata. However, several escalating signals are MISSING and should temper urgency: no EPSS score is provided, the issue is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vector and the SQL-injection mechanism (CWE-89) are internally consistent with the description, so there is no conflict between the CVSS data and the narrative. Net: treat as an urgent patch item specifically for self-hosted multi-organization instances, but exploitation likelihood data is absent rather than elevated.

A customer or insider holding a low-privilege project API key with read:runs scope on a shared self-hosted Trigger.dev instance sends a request to /realtime/v1/runs with a malicious tags parameter that injects a boolean SQL condition. Because the parameter is concatenated unescaped into the ElectricSQL shape where clause, the injected clause overrides the runtimeEnvironmentId tenant guard and streams TaskRun records - including payloads and metadata - belonging to every other organization on the instance. No public exploit code is referenced, so exploitation currently requires the attacker to craft the injection manually.