Live › vulnerability › CVE-2026-114081
Go to dashboardTrigger.dev before 4.5.6 concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. An authenticated customer can send a backtick-quoted identifier to the query API and read other organizations' analytics data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or multi-tenant deployments of Trigger.dev before 4.5.6 where customers hold authenticated accounts that can call the TSQL query API. Single-tenant installs where every user is trusted are less exposed, but the sources do not say how far that reduces risk.
No product ranges from the sources yet.
unknown for the exact package name and lockfile path, but confirm whether the version is below 4.5.64.5.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.
This page as .md · .json · in your agent: get_signal("CVE-2026-114081")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.