Triggerdotdev

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-114087	Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected.	CRITICAL	9.2	0.3%	46
CVE-2026-114085	Trigger.dev self-hosted and cloud deployments through version 4.7.6 expose a supervisor workload API endpoint (attempts/start) that performs no ownership check, letting a caller act on runs and snapshots belonging to other deployments. Exploitation is not anonymous: an attacker must already hold a legitimate low-privilege run/snapshot pair and must reach the supervisor over an adjacent network segment, after which they can read resolved environment variables and run JWTs or start, complete, and suspend other tenants' runs. There is no public exploit code or confirmed active exploitation (no CISA KEV), and the vendor advisory GHSA-jc26-22qp-cgqj is the authoritative reference; risk concentrates in multi-tenant or hosted installations where untrusted workloads share a supervisor, while single-tenant self-hosted setups with no third-party workloads are materially less exposed.	HIGH	8.8	0.2%	44	No patch
CVE-2026-114089	Cross-site request forgery in Trigger.dev before 4.5.2 lets an attacker mint a Personal Access Token for a logged-in victim and then collect it from the unauthenticated /api/v1/token endpoint, resulting in full account takeover. The flaw affects Trigger.dev deployments running versions prior to 4.5.2 and requires only that the victim have an active authenticated session and be lured into opening a crafted /account/authorization-code/<code> URL. No public exploit identified at time of analysis; the vendor advisory GHSA-58mc-m3qq-6qrh and the VulnCheck advisory provide further detail, and upgrading to 4.5.2 addresses the vulnerable flow.	HIGH	8.7	0.1%	44
CVE-2026-114083	Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach.	HIGH	8.6	0.4%	43
CVE-2026-114069	Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.	HIGH	8.6	0.3%	43
CVE-2026-114092	Trigger.dev's dashboard run replay endpoint lets an attacker who knows or enumerates a run friendlyId replay another organization's task run into an environment of the attacker's choosing, potentially exposing task payloads and executing the task with the victim's secrets. The vendor CVSS 4.0 score is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N), with an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; the CVSS PR:N designation suggests unauthenticated access, although the GHSA's 'any authenticated user' wording means authentication requirements are not definitively confirmed. Publicly available exploit code exists (a PoC POST request is included in the GHSA), but no CISA KEV entry or confirmed active exploitation appears in the supplied data.	HIGH	8.3	0.4%	42
CVE-2026-114081	Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6.	HIGH	8.3	0.3%	42
CVE-2026-114084	SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis.	HIGH	8.3	0.3%	42
CVE-2026-114088	Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.	HIGH	8.3	0.3%	42
CVE-2026-114078	Cross-organization schedule deletion and disabling in Trigger.dev before 4.5.6 allows authenticated users with their own project schedule route to target another organization's IMPERATIVE cron schedule by supplying the victim schedule's friendlyId to delete or disable actions. The flaw is a CWE-639 authorization bypass/IDOR in DeleteTaskScheduleService and SetActiveOnTaskScheduleService, which resolve the friendlyId without scoping it to the caller's organization; exploitation requires authentication and knowledge or enumeration of the victim's friendlyId, and impact is limited to schedule integrity/availability with no data disclosure. No public exploit was identified at the time of analysis, and CISA KEV does not list this CVE.	HIGH	7.2	0.3%	36
CVE-2026-114066	Trigger.dev prior to 4.7.0 fails to enforce ownership checks on the parentRunId supplied to batch-creation endpoints, allowing authenticated holders of unrestricted environment API keys to suspend, indefinitely block, or inject errors into runs they do not own, including cross-organization or production runs on shared deployments. The flaw is rated CVSS 7.2 and is an IDOR-style missing authorization issue (CWE-639); no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated in multi-tenant or shared instances where foreign run IDs are reachable, and is materially lower in isolated single-tenant deployments.	HIGH	7.2	0.3%	36
CVE-2026-114082	Trigger.dev deployments before 4.6.2 return environment-wide S2 stream credentials to any caller who presents a public token with session write access and initializes session input, letting that narrowly scoped token reach every stream in the environment. With the leaked credential, an attacker talks to the S2 storage API directly to append to, create, or trim other sessions' and runs' streams, forging job output or permanently deleting records. Integrity and availability are both assessed high while confidentiality is unaffected, and exploitation is gated on possession of a valid session-write-capable public token (authenticated, PR:L) with no public exploit code or CISA KEV entry identified at time of analysis.	HIGH	7.2	0.3%	36
CVE-2026-114068	Trigger.dev before 4.6.0 fails to enforce organization scoping in the waitpoint token wait endpoint, allowing an authenticated attacker who holds any valid secret API key to supply another organization's run ID and make that run block indefinitely on a waitpoint the victim cannot complete; the same path can also inject resume data into the targeted run. This is an IDOR-class authorization flaw (CWE-639) affecting default multi-tenant deployments prior to 4.6.0, with the greatest practical impact on shared instances where keys from one organization can reference another organization's runs. No public exploit identified at time of analysis.	HIGH	7.2	0.3%	36
CVE-2026-114065	Tenant isolation bypass in Trigger.dev releases before 4.7.3 lets an authenticated user read run metadata and payloads belonging to other tenants by submitting crafted queries to POST /api/v1/query that reference tables through the 'FROM {database.table}' placeholder syntax, including inside subqueries. Only confidentiality is affected - the flaw exposes data but does not allow modification, deletion, or code execution - so the practical exposure is concentrated in shared SaaS or multi-tenant self-hosted deployments, while single-tenant installations have no other tenant data to disclose. Authentication with a valid account is required (CVSS PR:L), no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV; the assigned CVSS 4.0 score is 7.1, though an independent CVSS 3.1 assessment places it at 6.5 given the read-only impact.	HIGH	7.1	0.3%	36
CVE-2026-114067	Improper authorization in Trigger.dev 4.5.0 through 4.6.1 lets authenticated holders of a valid public session token obtain presigned S3 write URLs and overwrite their own session's durable chat snapshot, forging the agent's conversation history. The PUT snapshot-url session endpoint lacks a secret-key-only authorization check, and the affected range ends before 4.6.2. No public exploit code has been identified at the time of analysis, and the independent assessment limits impact to the token holder's own session with no confidentiality, availability, or cross-tenant effect.	HIGH	7.1	0.2%	36

CVE-2026-114087

Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected.

CRITICAL

9.2

0.3%

46

CVE-2026-114085

Trigger.dev self-hosted and cloud deployments through version 4.7.6 expose a supervisor workload API endpoint (attempts/start) that performs no ownership check, letting a caller act on runs and snapshots belonging to other deployments. Exploitation is not anonymous: an attacker must already hold a legitimate low-privilege run/snapshot pair and must reach the supervisor over an adjacent network segment, after which they can read resolved environment variables and run JWTs or start, complete, and suspend other tenants' runs. There is no public exploit code or confirmed active exploitation (no CISA KEV), and the vendor advisory GHSA-jc26-22qp-cgqj is the authoritative reference; risk concentrates in multi-tenant or hosted installations where untrusted workloads share a supervisor, while single-tenant self-hosted setups with no third-party workloads are materially less exposed.

HIGH

8.8

0.2%

44

No patch

CVE-2026-114089

Cross-site request forgery in Trigger.dev before 4.5.2 lets an attacker mint a Personal Access Token for a logged-in victim and then collect it from the unauthenticated /api/v1/token endpoint, resulting in full account takeover. The flaw affects Trigger.dev deployments running versions prior to 4.5.2 and requires only that the victim have an active authenticated session and be lured into opening a crafted /account/authorization-code/<code> URL. No public exploit identified at time of analysis; the vendor advisory GHSA-58mc-m3qq-6qrh and the VulnCheck advisory provide further detail, and upgrading to 4.5.2 addresses the vulnerable flow.

HIGH

8.7

0.1%

44

CVE-2026-114083

Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach.

HIGH

8.6

0.4%

43

CVE-2026-114069

Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis.

HIGH

8.6

0.3%

43

CVE-2026-114092

Trigger.dev's dashboard run replay endpoint lets an attacker who knows or enumerates a run friendlyId replay another organization's task run into an environment of the attacker's choosing, potentially exposing task payloads and executing the task with the victim's secrets. The vendor CVSS 4.0 score is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N), with an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; the CVSS PR:N designation suggests unauthenticated access, although the GHSA's 'any authenticated user' wording means authentication requirements are not definitively confirmed. Publicly available exploit code exists (a PoC POST request is included in the GHSA), but no CISA KEV entry or confirmed active exploitation appears in the supplied data.

HIGH

8.3

0.4%

42

CVE-2026-114081

Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6.

HIGH

8.3

0.3%

42

CVE-2026-114084

SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis.

HIGH

8.3

0.3%

42

CVE-2026-114088

Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue.

HIGH

8.3

0.3%

42

CVE-2026-114078

Cross-organization schedule deletion and disabling in Trigger.dev before 4.5.6 allows authenticated users with their own project schedule route to target another organization's IMPERATIVE cron schedule by supplying the victim schedule's friendlyId to delete or disable actions. The flaw is a CWE-639 authorization bypass/IDOR in DeleteTaskScheduleService and SetActiveOnTaskScheduleService, which resolve the friendlyId without scoping it to the caller's organization; exploitation requires authentication and knowledge or enumeration of the victim's friendlyId, and impact is limited to schedule integrity/availability with no data disclosure. No public exploit was identified at the time of analysis, and CISA KEV does not list this CVE.

HIGH

7.2

0.3%

36

CVE-2026-114066

Trigger.dev prior to 4.7.0 fails to enforce ownership checks on the parentRunId supplied to batch-creation endpoints, allowing authenticated holders of unrestricted environment API keys to suspend, indefinitely block, or inject errors into runs they do not own, including cross-organization or production runs on shared deployments. The flaw is rated CVSS 7.2 and is an IDOR-style missing authorization issue (CWE-639); no public exploit code or CISA KEV entry was identified at time of analysis. Risk is concentrated in multi-tenant or shared instances where foreign run IDs are reachable, and is materially lower in isolated single-tenant deployments.

HIGH

7.2

0.3%

36

CVE-2026-114082

Trigger.dev deployments before 4.6.2 return environment-wide S2 stream credentials to any caller who presents a public token with session write access and initializes session input, letting that narrowly scoped token reach every stream in the environment. With the leaked credential, an attacker talks to the S2 storage API directly to append to, create, or trim other sessions' and runs' streams, forging job output or permanently deleting records. Integrity and availability are both assessed high while confidentiality is unaffected, and exploitation is gated on possession of a valid session-write-capable public token (authenticated, PR:L) with no public exploit code or CISA KEV entry identified at time of analysis.

HIGH

7.2

0.3%

36

CVE-2026-114068

Trigger.dev before 4.6.0 fails to enforce organization scoping in the waitpoint token wait endpoint, allowing an authenticated attacker who holds any valid secret API key to supply another organization's run ID and make that run block indefinitely on a waitpoint the victim cannot complete; the same path can also inject resume data into the targeted run. This is an IDOR-class authorization flaw (CWE-639) affecting default multi-tenant deployments prior to 4.6.0, with the greatest practical impact on shared instances where keys from one organization can reference another organization's runs. No public exploit identified at time of analysis.

HIGH

7.2

0.3%

36

CVE-2026-114065

Tenant isolation bypass in Trigger.dev releases before 4.7.3 lets an authenticated user read run metadata and payloads belonging to other tenants by submitting crafted queries to POST /api/v1/query that reference tables through the 'FROM {database.table}' placeholder syntax, including inside subqueries. Only confidentiality is affected - the flaw exposes data but does not allow modification, deletion, or code execution - so the practical exposure is concentrated in shared SaaS or multi-tenant self-hosted deployments, while single-tenant installations have no other tenant data to disclose. Authentication with a valid account is required (CVSS PR:L), no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV; the assigned CVSS 4.0 score is 7.1, though an independent CVSS 3.1 assessment places it at 6.5 given the read-only impact.

HIGH

7.1

0.3%

36

CVE-2026-114067

Improper authorization in Trigger.dev 4.5.0 through 4.6.1 lets authenticated holders of a valid public session token obtain presigned S3 write URLs and overwrite their own session's durable chat snapshot, forging the agent's conversation history. The PUT snapshot-url session endpoint lacks a secret-key-only authorization check, and the affected range ends before 4.6.2. No public exploit code has been identified at the time of analysis, and the independent assessment limits impact to the token holder's own session with no confidentiality, availability, or cross-tenant effect.

HIGH

7.1

0.2%

36

Severity Breakdown

Monthly CVE Trend

Affected Products (7)

Top Risky CVEs