Live › vulnerability › CVE-2026-114085
Go to dashboardTrigger.dev's supervisor workload server does not authenticate callers or check run ownership. A workload with network access to the supervisor and a valid run/snapshot pair can call attempts/start on another deployment's run. That returns the run's resolved environment variables and a run JWT, and it can also start, complete, suspend or continue the run. IDs are high-entropy and there is no enumeration primitive. The vendor says the managed service now uses signed deployment-scoped tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| trigger.dev | npm | <= 4.7.6 (CVE); <= 4.6.0 (GHSA) | – |
4.6.0 is affected but the CVE says through 4.7.64.6.0, but the CVE record says versions through 4.7.6 are affected4.7.6 and check the release notesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114085")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.