{"id":"CVE-2026-114092","kind":"vulnerability","aliases":["CVE-2026-114092"],"related":[],"title":"Trigger.dev: unauthenticated run replay leaks payloads and reruns tasks","description":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.","summary":"Trigger.dev versions before 4.5.0 let anyone who knows a run's friendlyId replay that run into an environment the attacker chooses, because the dashboard replay route has no authentication or organization check. An attacker can read the victim's task payload or re-execute the task with the victim's secrets.","severity":"high","cvss":8.3,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","package","self-hosted","trigger.dev"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed Trigger.dev version and confirm whether it is below `4.5.0`\n- Confirm whether the dashboard is reachable from the internet or an untrusted network","fix":"- Upgrade Trigger.dev to `4.5.0` or later\n- Rotate secrets used by tasks if the dashboard was exposed while running an affected version (unknown whether the sources require this)","status":"open","published_at":"2026-10-21T01:17:34+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:02:10+00:00","updated_at":"2026-10-25T03:02:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:02:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trigger.dev to `4.5.0` or later\n- Rotate secrets used by tasks if the dashboard was exposed while running an affected version (unknown whether the sources require this)","reach":"internet","title":"Trigger.dev: unauthenticated run replay leaks payloads and reruns tasks","impact":"high","summary":"Trigger.dev versions before 4.5.0 let anyone who knows a run's friendlyId replay that run into an environment the attacker chooses, because the dashboard replay route has no authentication or organization check. An attacker can read the victim's task payload or re-execute the task with the victim's secrets.","category":"package","nicknames":[],"who_cares":["trigger.dev","self-hosted","node.js"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads task payloads and reruns tasks with victim secrets","analyst_note":"Confirm from the NVD entry or the Trigger.dev release notes whether the managed cloud service is affected and whether the dashboard requires a network-exposed deployment to be exploitable.","how_to_check":"- Check the installed Trigger.dev version and confirm whether it is below `4.5.0`\n- Confirm whether the dashboard is reachable from the internet or an untrusted network","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that self-host the Trigger.dev dashboard on a version before `4.5.0` and expose it to users or networks beyond the trusted operators. The sources do not say whether Trigger.dev Cloud is affected, so unknown for managed hosting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3386,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114092':12A,15A '-2026':11A,14A '4.5.0':25B,76C 'action':85C 'alon':102C 'anyon':27B 'attack':41B,55B,105C 'authent':50B,79C 'check':53B,82C 'choos':42B,121C 'cve':10A,13A 'dashboard':45B,89C 'environ':39B,118C 'execut':66B 'expos':122C 'friendlyid':33B,101C,112C 'handler':86C 'host':20B 'know':29B,107C 'leak':5A 'let':26B 'look':96C 'node.js':16B 'organ':52B,81C 'packag':17B 'payload':6A,62B,127C 'perform':77C 're':65B 're-execut':64B 'read':57B 'remot':104C 'replay':4A,34B,46B,91C,114C 'rerun':8A 'resources.taskruns':93C 'rout':47B,92C 'run':3A,31B,36B,90C,99C,111C,129C 'runparam.replay':94C 'secret':73B,137C 'self':19B 'self-host':18B 'task':9A,61B,68B,126C,131C 'trigger.dev':1A,21B,22B,74C 'unauthent':2A 'version':23B 'victim':59B,71B,109C,124C,135C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host the Trigger.dev dashboard on a version before `4.5.0` and expose it to users or networks beyond the trusted operators. The sources do not say whether Trigger.dev Cloud is affected, so unknown for managed hosting.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114092","severity":null,"published_at":"2026-10-21T01:17:34+00:00","modified_at":"2026-10-22T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114092","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114092","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}