Trigger.dev EUVD-2026-58479

The cross-tenant replay flaw requires: (1) the attacker holds any valid Trigger.dev environment API key (PR:L - a legitimate developer account suffices; no admin privilege is needed); and (2) the attacker can identify or enumerate the friendlyId of a run belonging to a different tenant - IDs are not inherently secret and may appear in logs, error messages, or be derivable from patterns. No special server configuration is needed for this dimension; the missing tenant filter is a code defect present in all affected versions regardless of deployment mode. The chained payload injection path adds two additional requirements: the victim run must use payloadType: application/store (not the default inline payload mode), AND a separate object-store path-traversal vulnerability must be exploitable by the attacker to overwrite the stored payload at the target key - this is a distinct, unconfirmed second vulnerability, making the combined chain AC:H. The CVSS PR:L rating confirms that exploitation requires authenticated access; fully unauthenticated exploitation is not supported by the available data. Single-tenant deployments where all API keys belong to one organization are not exposed to the cross-tenant replay impact.

The NVD CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) captures the authenticated and high-complexity nature of the attack but likely understates real-world business impact in multi-tenant SaaS deployments. The AC:H rating is justified: the attacker must know or enumerate another tenant's friendlyId, and the payload injection path additionally requires a chained object-store path-traversal vulnerability. The I:L/A:L scoring reflects repeated unintended side effects and resource consumption, which in workflows involving billing, financial APIs, or external integrations can translate to significant operational harm disproportionate to the low CVSS subscore. The assigned S:U is debatable - tenant boundary crossing in multi-tenant SaaS architecturally resembles a scope change (S:C); this analyst rates it S:C. No EPSS score was provided in the input data; no CISA KEV listing exists; no public POC has been identified. This is not a zero-interaction vulnerability: exploitation minimally requires a valid API key and knowledge of a victim run friendlyId. Single-tenant self-hosted deployments are not meaningfully exposed to the cross-tenant dimension.

An attacker holding a legitimately obtained or compromised Trigger.dev environment API key enumerates or guesses a friendlyId from a victim tenant's task run (IDs may follow predictable patterns or be discoverable via shared logs or error messages), then issues POST /api/v1/runs/{victim-friendlyId}/replay using their own key. Because the replay endpoint queries by friendlyId without a tenant filter, the request succeeds and ReplayTaskRunService executes the run in the victim's environment - consuming their compute quota and re-firing any side effects such as payment webhooks or third-party API mutations. In a chained escalation, if the attacker has separately exploited an object-store path-traversal to overwrite the victim run's stored payload, the replayed execution processes attacker-controlled input through the victim tenant's task logic.