{"schema":"threatline.record/2","record":{"id":"GHSA-m79r-84cc-xwg9","aliases":["GHSA-m79r-84cc-xwg9"],"summary":"Tenant filtering bypass in query table placeholders","details":"### Summary\r\n\r\nWe have confirmed that this has not been exploited in our cloud, and is now fully patched.\r\n\r\nA tenant-filtering bypass affected POST /api/v1/query. Table references using placeholder syntax could bypass the query compiler’s table allowlist and tenant filters.\r\n\r\nAn authenticated caller authorized to use the query endpoint could use this syntax to read data belonging to other tenants, subject to the query connection’s database permissions.\r\n\r\n### Details\r\n\r\nThe compiler applied table validation and tenant filters to normal table references, but not to placeholder table expressions such as FROM {database.table}. These expressions were emitted as physical table references without the enforced organization, project, and environment predicates.\r\n\r\nThe issue also affected placeholder table references within subqueries. Compiler-level reproduction confirmed that these references produced SQL without tenant filters.\r\n\r\n### Impact\r\n\r\nThe issue could expose other tenants’ data in tables readable by the query connection, including run metadata and payloads where accessible. It did not permit data modification through the query endpoint.","categories":["Frameworks"],"product":"trigger.dev","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-m79r-84cc-xwg9","source_modified_at":"2026-10-06T13:40:20Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"npm","name":"trigger.dev"},"range":"<= 4.7.2"}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T13:40:20Z","modified_at":"2026-10-06T13:40:20Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-m79r-84cc-xwg9","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-10-06T13:40:20Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T13:40:20Z","content_hash":"f0a2b4fc3168c6daca62e718967d9a30edcd220011b432acc9bf6f4fa487424c"}}