high · CVSS v3 7.9

CVE-2026-114085

Trigger.dev 4.7.6 has a missing authentication flaw in its supervisor workload server, letting attackers with network access manipulate runs

Overview

Trigger.dev 4.7.6 has a missing authentication flaw in its supervisor workload server, letting attackers with network access manipulate runs of other tenants. This can expose environment variables, JWTs, and allow unauthorized run control. The vulnerability affects multi‑tenant deployments that rely on the attempts/start endpoint.

Description

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

Impact

Confidentiality is compromised when attackers retrieve resolved environment variables and run JWTs. Integrity is at risk as attackers can start, complete, or suspend runs belonging to other tenants. Availability may be impacted if malicious run manipulation overloads the system. Defenders of multi‑tenant Trigger.dev deployments should treat this as a critical control issue.

Remediation

Apply the official patch to Trigger.dev 4.7.7 or later. If patching is delayed, restrict network access to the supervisor workload server to trusted IPs and enforce strict authentication before processing attempts/start requests. Verify that ownership checks are in place and monitor logs for anomalous run activity.

Risk context

The CVSS v3 score of 7.9 classifies this as high severity. With no EPSS data, the urgency is based on the severity and the potential for cross‑tenant data exposure. Defenders should prioritize remediation to prevent data leakage and unauthorized run control.

Affected products

  • Trigger.dev 4.7.6
  • Trigger.dev Supervisor Workload Server

Scores

Severity
high
CVSS v2
6.2
CVSS v3
7.9
CVSS v4
—
EPSS
—

Trigger.dev authentication confidentiality integrity multi-tenant high-severity access-control

← All CVEs

Related CVEs

high

CVE-2026-114063

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users read arbitrary files outside the prerendered output. The vulnerability can leak source code, configuration, or credentials if the preview server is reachable over the network. It is critical for deployments that expose the preview server to the internet or internal network.

View analysis

high

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

View analysis

high

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

View analysis

high

CVE-2026-114069

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

View analysis