All vulnerabilities
CVE-2026-114092GHSA-9fq3-68cw-r7p2GHSA-pp95-gc86-jq6q

Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

triggerdotdev trigger.devnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
8.3High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 36% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0Also 4.5.2CVE List
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 4.5.0trigger.devCVE List
  • 4.5.2trigger.dev, npmOSVnpm install trigger.dev@4.5.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.

Text from CVE List

Affected versions 3

  • trigger.devaffected: all versions before 4.5.0CVE List
  • trigger.devunaffected: 4.5.0CVE List
  • trigger.dev, npmfrom first release, fixed in 4.5.2OSV

References 3