---
id: "CVE-2026-114085"
kind: "vulnerability"
aliases: ["CVE-2026-114085"]
title: "Trigger.dev: workload server flaw lets tenants hijack other tenants' runs"
severity: "high"
cvss: 8.8
epss: 0.00162
exploited: false
status: "open"
category: "package"
products: [{"name": "trigger.dev", "fixed": [], "affected": "<= 4.7.6 (CVE); <= 4.6.0 (GHSA)", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["multi-tenant", "package", "self-hosted", "supervisor", "trigger.dev"]
not_affected_if: ["managed-hosting", "single-tenant"]
published_at: "2026-10-21T01:17:33+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-24T13:15:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114085", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:49:45+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114085", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev: workload server flaw lets tenants hijack other tenants' runs

Trigger.dev's supervisor workload server does not authenticate callers or check run ownership. A workload with network access to the supervisor and a valid run/snapshot pair can call attempts/start on another deployment's run. That returns the run's resolved environment variables and a run JWT, and it can also start, complete, suspend or continue the run. IDs are high-entropy and there is no enumeration primitive. The vendor says the managed service now uses signed deployment-scoped tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:trigger.dev affected <= 4.7.6 (CVE); <= 4.6.0 (GHSA) fixed ?

## How to check

Self-hosted: check the supervisor/trigger.dev version, and whether the supervisor workload API (default port 8020, TRIGGER_WORKLOAD_API_ENABLED defaults to true) is reachable from untrusted workloads. Versions: the GHSA says <= 4.6.0 is affected but the CVE says through 4.7.6.

## Fix

Vendor GHSA lists patched >= 4.6.0, but the CVE record says versions through 4.7.6 are affected. Upgrade to the latest release above 4.7.6 and check the release notes. Until then, restrict network access to the supervisor workload port so untrusted workloads cannot reach it.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114085
- 2026-10-23T23:49:45+00:00 analyst — Read vendor GHSA-jc26-22qp-cgqj (published Sep 14) and CVE/VulnCheck record. Version conflict: GHSA says affected <=4.6.0, patched >=4.6.0; CVE says through 4.7.6. Fixed version not settled; no exploitation or public PoC beyond the curl repro in the GHSA. Did not search X or HN.
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114085

## Documents

- [advisory] GHSA-jc26-22qp-cgqj: Supervisor workload API lacks cross-tenant authentication https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj
- [describes] VulnCheck: Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api

## From the sources

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_