trigger.dev: Tenant filtering bypass in query table placeholders

Summary

We have confirmed that this has not been exploited in our cloud, and is now fully patched.

A tenant-filtering bypass affected POST /api/v1/query. Table references using placeholder syntax could bypass the query compiler’s table allowlist and tenant filters.

An authenticated caller authorized to use the query endpoint could use this syntax to read data belonging to other tenants, subject to the query connection’s database permissions.

Details

The compiler applied table validation and tenant filters to normal table references, but not to placeholder table expressions such as FROM {database.table}. These expressions were emitted as physical table references without the enforced organization, project, and environment predicates.

The issue also affected placeholder table references within subqueries. Compiler-level reproduction confirmed that these references produced SQL without tenant filters.

Impact

The issue could expose other tenants’ data in tables readable by the query connection, including run metadata and payloads where accessible. It did not permit data modification through the query endpoint.