CVE-2026-114092: Missing Authentication for Critical Function in triggerdotdev trigger.dev
Description
Trigger.dev versions before 4.5.0 have a missing authentication vulnerability in the dashboard run replay route. This flaw allows an attacker who knows a victim's run friendlyId to replay that run without authentication or organization checks. The attacker can expose the victim's task payload or execute the task again with the victim's secrets.
CVSS v4.0
Score 8.3high
Affected software
triggerdotdev
trigger.dev
pkg:github/triggerdotdev/trigger.devRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Trigger.dev prior to version 4.5.0 does not perform authentication or verify organizational ownership in the action handler for the dashboard run replay route (resources.taskruns.$runParam.replay). The system identifies runs solely by a friendlyId, which can be guessed or known by an attacker. This allows a remote attacker to replay a victim's run in an environment of their choosing, potentially exposing sensitive task payload data or rerunning tasks with the victim's secrets.
Potential Impact
An attacker can remotely replay task runs without authentication, leading to exposure of sensitive task payloads and unauthorized execution of tasks with victim secrets. This can compromise confidentiality and integrity of the victim's data and operations within Trigger.dev environments.
Mitigation Recommendations
A fix is available in Trigger.dev version 4.5.0 and later. Users should upgrade to version 4.5.0 or newer to ensure authentication and organization checks are enforced on the dashboard run replay route. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:46:55.741Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c062cdf04f6568caa48
Added to database: 10/21/2026, 00:49:10 UTC
Last enriched: 10/21/2026, 01:18:21 UTC
Last updated: 10/21/2026, 01:48:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.