CVE-2026-114072GHSA-hc5h-gqhc-4h79
Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State
triggerdotdev trigger.devFrameworks
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.5.12trigger.devCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
Text from CVE List
Affected versions 2
- trigger.devaffected: all versions before 4.5.12CVE List
- trigger.devunaffected: 4.5.12CVE List