Live › vulnerability › CVE-2026-114091
Go to dashboardTrigger.dev before 4.5.0 looks up runs by friendlyId alone in the replay route, without scoping to the caller's environment. An attacker with any tenant's API key and a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Trigger.dev before 4.5.0, both self-hosted and on the hosted service, where more than one tenant or environment holds API keys. Single-tenant deployments with one trusted API key have little exposure to cross-environment replay. unknown whether the hosted service was patched by the vendor.
No product ranges from the sources yet.
npx trigger.dev@latest --version or the version in package.json) and confirm it is below 4.5.0api.v1.runs.$runParam.replay4.5.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-114091")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.