Live › vulnerability › CVE-2026-114072
Go to dashboardThe Trigger.dev webapp before 4.5.12 uses the organization ID as the Slack OAuth state without tying it to the user's session, so it is open to cross-site request forgery. An attacker who knows a target organization ID can trick an logged-in member into connecting an attacker-controlled Slack workspace that then receives the organization's operational alerts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a self-hosted or cloud Trigger.dev webapp older than 4.5.12 that use the organization-level Slack integration. Exposure requires an authenticated member to open an attacker-supplied callback link. Teams not using the Slack integration, or already on 4.5.12 or later, can skip it.
No product ranges from the sources yet.
4.5.124.5.12 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
This page as .md · .json · in your agent: get_signal("CVE-2026-114072")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.