Live › vulnerability › CVE-2026-114071
Go to dashboardTrigger.dev before 4.5.12 skips a per-user environment ownership check on waitpoints. An authenticated project member who knows a victim's waitpoint friendly ID can mark that pending DEVELOPMENT waitpoint completed early.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a self-hosted or hosted Trigger.dev instance before 4.5.12 where several users share a project and use development environments with waitpoints. Exposure depends on a member knowing a victim's waitpoint friendly ID. Single-user projects and teams already on 4.5.12 or later can skip it.
No product ranges from the sources yet.
npm ls @trigger.dev/sdk or the server image tag.4.5.12 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.
This page as .md · .json · in your agent: get_signal("CVE-2026-114071")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.