EUVD-2026-71115
GHSA-r87q-rjwf-c49g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated attacker (PR:L) crosses tenant boundaries (S:C), injecting runs into victim environments with high integrity and low availability impact, no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
AnalysisAI
Missing authorization on the run replay API endpoint in Trigger.dev before 4.5.2 allows authenticated attackers to inject task runs into environments belonging to other organizations or projects. By replaying their own historical runs into victim environments, attackers can consume victim compute resources and permanently pollute that organization's run history and audit logs. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account (any role) on the same Trigger.dev instance as the victim organization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L, score 8.4) accurately reflects the threat model: network-accessible, low complexity, requires only a legitimate user account (PR:L), and produces high integrity impact on both the vulnerable system and subsequent tenant systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Trigger.dev to version 4.5.2 or later; the patching commit is 34b1a181c2a1d33a53ebab88f84b05f81fea4254 and the release is tagged at https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify your Trigger.dev version and confirm whether you operate a multi-tenant instance where multiple customer organizations share platform access; check Trigger.dev upgrade documentation for your deployment method (SaaS vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Trigger Dev
View allPrototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corru
Cross-tenant authorization bypass in Trigger.dev before 4.5.6 lets a caller holding a valid API key for one project act
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding
Path traversal in Trigger.dev's packet presign API routes (versions 4.4.2 through 4.4.x) allows a holder of any valid pr
Account takeover in Trigger.dev before 4.5.2 allows an unauthenticated remote attacker to hijack any existing user accou
Server-side request forgery in Trigger.dev before 4.5.2 allows authenticated organization members to register webhook al
Cross-tenant run replay in Trigger.dev 4.4.2-4.5.0-rc.3 allows any authenticated API key holder to replay task runs belo
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today