Live › vulnerability › CVE-2026-114066
Go to dashboardTrigger.dev before 4.7.0 does not check that a parentRunId belongs to the caller on its batch-creation endpoints. A holder of an unrestricted environment API key can suspend, block or inject errors into production and cross-organization runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Trigger.dev before 4.7.0, especially self-hosted deployments or setups where multiple organizations or environments share a deployment. Exposure depends on holding an unrestricted environment API key, so the risk is mainly from insiders or leaked keys. Hosted users should check whether the provider has already patched.
No product ranges from the sources yet.
trigger.dev image or package tag) and see if it is below 4.7.04.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114066")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.