Live › vulnerability › CVE-2026-114092
Go to dashboardTrigger.dev versions before 4.5.0 let anyone who knows a run's friendlyId replay that run into an environment the attacker chooses, because the dashboard replay route has no authentication or organization check. An attacker can read the victim's task payload or re-execute the task with the victim's secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host the Trigger.dev dashboard on a version before and expose it to users or networks beyond the trusted operators. The sources do not say whether Trigger.dev Cloud is affected, so unknown for managed hosting.
4.5.0No product ranges from the sources yet.
4.5.04.5.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-114092")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.