{"id":"CVE-2026-114085","kind":"vulnerability","aliases":["CVE-2026-114085"],"related":[],"title":"Trigger.dev: workload server flaw lets tenants hijack other tenants' runs","description":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.","summary":"Trigger.dev's supervisor workload server does not authenticate callers or check run ownership. A workload with network access to the supervisor and a valid run/snapshot pair can call attempts/start on another deployment's run. That returns the run's resolved environment variables and a run JWT, and it can also start, complete, suspend or continue the run. IDs are high-entropy and there is no enumeration primitive. The vendor says the managed service now uses signed deployment-scoped tokens.","severity":"high","cvss":8.8,"epss":0.00162,"exploited":false,"exploited_at":null,"products":[{"name":"trigger.dev","fixed":[],"affected":"<= 4.7.6 (CVE); <= 4.6.0 (GHSA)","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["multi-tenant","package","self-hosted","supervisor","trigger.dev"],"not_affected_if":["managed-hosting","single-tenant"],"how_to_check":"Self-hosted: check the supervisor/trigger.dev version, and whether the supervisor workload API (default port 8020, TRIGGER_WORKLOAD_API_ENABLED defaults to true) is reachable from untrusted workloads. Versions: the GHSA says <= 4.6.0 is affected but the CVE says through 4.7.6.","fix":"Vendor GHSA lists patched >= 4.6.0, but the CVE record says versions through 4.7.6 are affected. Upgrade to the latest release above 4.7.6 and check the release notes. Until then, restrict network access to the supervisor workload port so untrusted workloads cannot reach it.","status":"open","published_at":"2026-10-21T01:17:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:33:33+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:33:33Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Trigger.dev to a release later than 4.7.6; the sources do not name the fixed version.","reach":"network","title":"Trigger.dev: workload server flaw lets tenants hijack other tenants' runs","impact":"high","summary":"Trigger.dev through 4.7.6 has a missing authentication check in its supervisor workload server, so a workload can act on runs owned by other deployments. An attacker with network access and a valid run/snapshot pair can read resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.","category":"package","who_cares":["trigger.dev","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads secrets and controls other tenants' runs","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000966,"input_tokens":2964,"output_tokens":1340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Trigger.dev version and the supervisor endpoint hardening details at the NVD page and the project's advisory or changelog; confirm how the valid run/snapshot pair is obtained.","search":"'-114085':13A,16A '-2026':12A,15A '4.7.6':110C 'access':44B,137C 'allow':122C 'also':76B 'anoth':57B 'attack':134C 'attempts/start':55B,146C 'authent':34B,114C 'belong':127C 'call':54B,144C 'caller':35B 'check':37B 'complet':78B,158C 'contain':111C 'continu':81B 'cve':11A,14A 'deploy':58B,105B,130C 'deployment-scop':104B 'endpoint':147C 'entropi':88B 'enumer':93B 'environ':67B,151C 'flaw':4A 'high':87B 'high-entropi':86B 'hijack':7A 'host':24B 'id':84B 'jwt':72B 'jwts':155C 'let':5A 'manag':99B 'manipul':125C 'miss':113C 'multi':19B 'multi-ten':18B 'network':43B,136C 'obtain':149C 'ownership':39B,132C 'packag':21B 'pair':52B,142C 'primit':94B 'resolv':66B,150C 'return':62B 'run':10A,38B,60B,64B,71B,83B,126C,154C,163C 'run/snapshot':51B,141C 'say':97B 'scope':106B 'self':23B 'self-host':22B 'server':3A,31B,120C 'servic':100B 'sign':103B 'start':77B,157C 'supervisor':25B,29B,47B,118C 'suspend':79B,160C 'tenant':6A,9A,20B,162C 'token':107B 'trigger.dev':1A,17A,26B,27B,108C 'use':102B 'valid':50B,140C 'variabl':68B,152C 'vendor':96B 'verif':133C 'vulner':115C 'without':131C 'workload':2A,30B,41B,119C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114085","severity":null,"published_at":"2026-10-21T01:17:33+00:00","modified_at":"2026-10-21T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114085:527","url":null,"severity":null,"published_at":"2026-10-23T23:49:45+00:00","modified_at":"2026-10-23T23:49:45+00:00","first_seen_at":"2026-10-23T23:49:45+00:00","fetched_at":"2026-10-23T23:49:45+00:00","note":"Read vendor GHSA-jc26-22qp-cgqj (published Sep 14) and CVE/VulnCheck record. Version conflict: GHSA says affected <=4.6.0, patched >=4.6.0; CVE says through 4.7.6. Fixed version not settled; no exploitation or public PoC beyond the curl repro in the GHSA. Did not search X or HN."},{"source":"epss","external_id":"CVE-2026-114085","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114085","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[{"id":2184,"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj","title":"GHSA-jc26-22qp-cgqj: Supervisor workload API lacks cross-tenant authentication","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2186,"url":"https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api","title":"VulnCheck: Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}