Live › vulnerability › CVE-2026-114068
Go to dashboardTrigger.dev before 4.6.0 has a missing authorization check on its waitpoint token wait endpoint. An authenticated user with any secret API key can attach their own waitpoint to another organization's run, which then blocks indefinitely and accepts injected resume data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Trigger.dev before 4.6.0 with more than one organization or with API keys shared across trust boundaries are exposed, since the attacker needs a valid secret key of their own. Single-tenant deployments where every key holder is trusted have less exposure; the sources do not say more.
No product ranges from the sources yet.
npx trigger.dev@latest --version or the version in package.json) and confirm whether it is below 4.6.0.4.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
This page as .md · .json · in your agent: get_signal("CVE-2026-114068")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.