CVE-2026-114081: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in triggerdotdev trigger.dev

CVE-2026-114081 is an SQL injection vulnerability affecting trigger.dev versions prior to 4.5.6. The vulnerability exists in the TSQL query compiler component, which improperly handles window-function names by concatenating them directly into ClickHouse SQL queries without allowlisting or escaping. This allows authenticated customers to submit backtick-quoted identifiers to the POST /api/v1/query endpoint, injecting raw subqueries outside the per-tenant WHERE clause guard. As a result, attackers can exfiltrate analytics data belonging to other tenants, violating data isolation.

The vulnerability enables authenticated users to bypass tenant data isolation controls and extract analytics data from other organizations sharing the same trigger.dev instance. This leads to unauthorized data disclosure and potential privacy violations. The CVSS 4.0 score of 8.3 reflects a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Users should upgrade trigger.dev to version 4.5.6 or later where this SQL injection vulnerability is fixed. Since the vulnerability is resolved in 4.5.6, applying this official fix fully mitigates the risk. No other mitigations are indicated by the vendor advisory.