Trigger.dev versions prior to 4.5.12 have a cross-site request forgery (CSRF) vulnerability in the organization-level Slack OAuth flow. The flaw arises because the OAuth state parameter uses only the organization ID without binding it to the user's session. An attacker who knows a target organization ID can trick an authenticated member into visiting a crafted Slack OAuth callback URL, potentially linking an attacker-controlled Slack workspace to the organization and receiving operational alerts.
Trigger.dev versions prior to 4.5.12 have an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint. This occurs by skipping the per-user environment ownership check when submitting certain waitpoint types with specific parameters. The vulnerability has a low CVSS score and was fixed in version 4.5.12.
Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.
Trigger.dev versions before 4.6.0 have an authorization bypass vulnerability in the waitpoint token wait endpoint. Authenticated attackers with any secret API key can block runs from other organizations indefinitely by supplying a victim's run ID with their own waitpoint. They can also inject resume data into the victim's run, potentially disrupting normal operation.
Trigger.dev versions 4.5.0 through before 4.6.2 have an improper authorization vulnerability in the PUT snapshot-url session endpoint. This flaw allows holders of public session tokens to obtain presigned S3 write URLs, enabling end users to overwrite their own session's durable chat snapshot and forge the agent's conversation history. The vulnerability arises because the endpoint lacks a secret-key-only authorization check.
Trigger.dev versions prior to 4.7.0 have an authorization bypass vulnerability that allows users with unrestricted environment API keys to interfere with runs they do not own. By supplying a foreign parentRunId to certain batch-creation endpoints, attackers can suspend, indefinitely block, or inject errors into production or cross-organization runs. This issue is fixed in version 4.7.0.
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
Trigger.dev versions before 4.6.0 contain an authorization bypass vulnerability where the application fails to verify that an authenticated user controls a GitHub App installation before associating it with their organization. This flaw allows attackers to claim another user's GitHub App installation by replaying state cookies and using sequential installation IDs, potentially gaining unauthorized access to the victim's repositories.
Trigger.dev versions from 4.4.2 up to but not including 4.5.0 contain a path traversal vulnerability in the packet presign routes. This flaw allows a caller-controlled filename to escape the intended restricted directory, enabling unauthorized read or overwrite access to other organizations' offloaded task payloads and outputs in multi-organization self-hosted instances. The vulnerability is fixed in version 4.5.0.
CVE-2026-73658 is a high-severity vulnerability in trigger.dev, a platform for building and deploying AI agents and workflows. Versions from 4.4.2 up to but not including 4.5.0-rc.5 have improper input validation in Aws4FetchClient methods that assign user-controlled keys to URL pathnames. This allows an attacker with a valid environment API key to bypass path normalization and obtain presigned URLs for other tenants' object-store keys, potentially reading or overwriting task payloads. The issue is fixed starting in version 4.5.0-rc.5. The vulnerability involves CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), and CWE-862 (Missing Authorization).
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.
Trigger.dev versions prior to 4.5.6 contain an authorization bypass vulnerability in the background worker deployment API. The flaw allows a user with a valid API key for one project to manipulate deployment identifiers from another project, linking an attacker-controlled background worker to a victim deployment and changing its state from BUILDING to DEPLOYING. This issue is resolved in version 4.5.6.
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.
Trigger.dev versions prior to 4.5.6 contain a prototype pollution vulnerability in the PUT /api/v1/runs/:runId/metadata endpoint. This flaw allows an attacker with a normal environment API key to modify Object.prototype in the shared webapp process, leading to corruption of Prisma queries and Prometheus labels, breaking authentication for other tenants, and causing a process-wide denial of service. The vulnerability is fixed in version 4.5.6.