Live › vulnerability › CVE-2026-114065
Go to dashboardTrigger.dev before 4.7.3 has a tenant filtering bypass in POST /api/v1/query: placeholder table syntax such as FROM {database.table} skips the table allowlist and tenant filters, including inside subqueries. An authenticated user can read other tenants' run metadata and payloads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or multi-tenant Trigger.dev deployments below 4.7.3 where tenants have authenticated accounts that can reach the query API. Single-tenant installs where only trusted users hold accounts face much less exposure. The sources do not say whether the hosted Trigger.dev service was affected.
No product ranges from the sources yet.
/api/v1/query endpoint to tenants4.7.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
This page as .md · .json · in your agent: get_signal("CVE-2026-114065")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.