37
CVEs
2
Critical
20
High
0
KEV
2
PoC
1
Unpatched C/H
97.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
20
MEDIUM
14
LOW
1
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73654 | Prototype pollution in Trigger.dev's run metadata API (versions 3.3.8 through 4.5.5) lets any authenticated tenant corrupt the shared Node.js webapp process's Object.prototype by supplying crafted path keys to the PUT /api/v1/runs/:runId/metadata endpoint. The root cause is the unsanitized use of attacker-supplied operation.key values passed directly to JSONHeroPath.set() in packages/core/src/v3/runMetadata/operations.ts without filtering __proto__, constructor, or prototype segments. A single exploiting tenant can corrupt Prisma ORM queries, poison Prometheus metric labels, break other tenants' worker authentication, and cause a process-wide denial of service - making this a multi-tenant isolation failure with scope-changed impact. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.5 | 0.3% | 63 |
PoC
|
| CVE-2026-73656 | Cross-tenant authorization bypass in Trigger.dev before 4.5.6 lets a caller holding a valid API key for one project act on another project's deployment. Because CreateDeploymentBackgroundWorkerServiceV4.call() looks up the deployment by friendlyId with no environmentId/tenant predicate, an attacker can attach an attacker-controlled background worker to a victim project's deployment and force it from BUILDING to DEPLOYING. No public exploit identified at time of analysis; the flaw is an insecure-direct-object-reference (IDOR) affecting the deployments API. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-114087 | Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected. | CRITICAL | 9.2 | 0.3% | 46 |
|
| CVE-2026-114085 | Trigger.dev self-hosted and cloud deployments through version 4.7.6 expose a supervisor workload API endpoint (attempts/start) that performs no ownership check, letting a caller act on runs and snapshots belonging to other deployments. Exploitation is not anonymous: an attacker must already hold a legitimate low-privilege run/snapshot pair and must reach the supervisor over an adjacent network segment, after which they can read resolved environment variables and run JWTs or start, complete, and suspend other tenants' runs. There is no public exploit code or confirmed active exploitation (no CISA KEV), and the vendor advisory GHSA-jc26-22qp-cgqj is the authoritative reference; risk concentrates in multi-tenant or hosted installations where untrusted workloads share a supervisor, while single-tenant self-hosted setups with no third-party workloads are materially less exposed. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-114089 | Cross-site request forgery in Trigger.dev before 4.5.2 lets an attacker mint a Personal Access Token for a logged-in victim and then collect it from the unauthenticated /api/v1/token endpoint, resulting in full account takeover. The flaw affects Trigger.dev deployments running versions prior to 4.5.2 and requires only that the victim have an active authenticated session and be lured into opening a crafted /account/authorization-code/<code> URL. No public exploit identified at time of analysis; the vendor advisory GHSA-58mc-m3qq-6qrh and the VulnCheck advisory provide further detail, and upgrading to 4.5.2 addresses the vulnerable flow. | HIGH | 8.7 | 0.1% | 44 |
|
| CVE-2026-114083 | Path traversal in Trigger.dev's api/v1/packets and api/v2/packets presigned-URL endpoints lets any holder of a single valid API key escape its tenant object-key prefix and read or overwrite other tenants' run payloads and outputs. Tracked as CVE-2026-114083 and rated 8.6 under CVSS 4.0 (assessed 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw affects releases before 4.5.0-rc.3 and requires authenticated, low-privilege tenant access with no user interaction and no named non-default configuration. No KEV listing or public exploit code was reported in the available intelligence, and real-world impact is concentrated on shared or multi-tenant deployments, since single-tenant self-hosted instances have no other tenants' objects to reach. | HIGH | 8.6 | 0.4% | 43 |
|
| CVE-2026-114069 | Trigger.dev before 4.6.0 exposes each environment's root TRIGGER_SECRET_KEY and other plaintext secrets through the GET /api/v1/projects/:projectRef/envvars endpoint, so an attacker holding a restricted read:envvars API key can escalate beyond that key's intended read-only scope. The affected environments are staging, production, and preview, and successful exploitation lets the attacker trigger tasks and mint admin public JWTs; exploitation requires a valid scoped key rather than anonymous access. This is a genuine priority rather than a high-score/low-real-risk issue, and no public exploit identified at time of analysis. | HIGH | 8.6 | 0.3% | 43 |
|
| CVE-2026-85651 | Missing authorization on the run replay API endpoint in Trigger.dev before 4.5.2 allows authenticated attackers to inject task runs into environments belonging to other organizations or projects. By replaying their own historical runs into victim environments, attackers can consume victim compute resources and permanently pollute that organization's run history and audit logs. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable by any authenticated platform user against any other tenant. | HIGH | 8.4 | 0.3% | 42 |
|
| CVE-2026-114092 | Trigger.dev's dashboard run replay endpoint lets an attacker who knows or enumerates a run friendlyId replay another organization's task run into an environment of the attacker's choosing, potentially exposing task payloads and executing the task with the victim's secrets. The vendor CVSS 4.0 score is 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N), with an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N; the CVSS PR:N designation suggests unauthenticated access, although the GHSA's 'any authenticated user' wording means authentication requirements are not definitively confirmed. Publicly available exploit code exists (a PoC POST request is included in the GHSA), but no CISA KEV entry or confirmed active exploitation appears in the supplied data. | HIGH | 8.3 | 0.4% | 42 |
|
| CVE-2026-114081 | Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-114084 | SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-114088 | Unauthenticated remote attackers can bypass Socket.IO authentication on self-hosted Trigger.dev webapps before 4.5.4 because the /coordinator namespace authenticates against a source-published default COORDINATOR_SECRET ('coordinator-secret') that is absent from the self-hosting docs, .env.example, and Helm values, so operators who never overrode it ship the published value. With that value an attacker can emit READY_FOR_EXECUTION to pull a run's decrypted environment variables (V1/marqs deployments, provided an internal runId is known) or send TASK_RUN_FAILED_TO_RUN, TASK_RUN_COMPLETED, CHECKPOINT_CREATED and similar events to tamper with arbitrary runs. No public exploit code or confirmed active exploitation was identified at time of analysis; exposure is confined to self-hosted deployments left on the default secret, and Trigger.dev Cloud is not implicated by this self-host default-configuration issue. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-73658 | Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding a valid environment API key to obtain presigned AWS S3 URLs scoped to another tenant's object-store keys, enabling unauthorized read and write access to task payloads. The flaw combines user-controlled packet path keys written directly into URL.pathname without dot-segment rejection and a stub ownership check (findResource: async () => 1) that unconditionally returns truthy for any requested resource. No public exploit code has been identified at time of analysis, though the mechanism is straightforward to reproduce from the CVE description alone, and the vendor has released a fix in v4.5.0-rc.5. | HIGH | 8.2 | 0.3% | 41 |
|
| CVE-2026-73659 | Path traversal in Trigger.dev's packet presign API routes (versions 4.4.2 through 4.4.x) allows a holder of any valid project API key to escape the intended packets/<projectRef>/<env>/ object-store prefix by injecting .. sequences into the caller-controlled filename parameter. On multi-organization self-hosted deployments, this enables cross-tenant reads and overwrites of offloaded task payloads and outputs. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 8.1 (High) rating reflects high confidentiality and integrity impact reachable by any authenticated project member without elevated privileges. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-73655 | Account takeover in Trigger.dev before 4.5.2 allows an unauthenticated remote attacker to hijack any existing user account that has not yet linked a Google OAuth identity, by presenting a Google profile whose email is unverified but matches the victim's registered address. The `addGoogleStrategy()` function in `apps/webapp/app/services/googleAuth.server.ts` omits the `email_verified` assertion before calling `findOrCreateGoogleUser()`, causing the server to bind the attacker's Google `authIdentifier` to the victim's account when the conditional `existingEmailUser && !existingUser` is satisfied. No public exploit has been identified at time of analysis, but the fix is available in v4.5.2 and the attack requires no Trigger.dev credentials. | HIGH | 7.4 | 0.4% | 37 |
|