All vulnerabilities
CVE-2026-114091GHSA-9fq3-68cw-r7p2

Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

triggerdotdev trigger.devFrameworks
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.

Text from CVE List

Affected versions 2

  • trigger.devaffected: all versions before 4.5.0CVE List
  • trigger.devunaffected: 4.5.0CVE List

References 2