Live › vulnerability › CVE-2026-114084
Go to dashboardTrigger.dev before 4.5.6 concatenates the tags query parameter unescaped into an ElectricSQL where clause on /realtime/v1/runs. An attacker with any project API key holding read:runs scope can append conditions and read TaskRun payloads and metadata from every organization on the same self-hosted instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running a self-hosted Trigger.dev instance before 4.5.6 with more than one organization or tenant on it. An attacker needs any project API key with read:runs scope. Hosted-only users with no self-hosted instance are not described as exposed by the sources.
No product ranges from the sources yet.
4.5.6.4.5.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
This page as .md · .json · in your agent: get_signal("CVE-2026-114084")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.