The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
Trigger.dev versions before 4.5.12 have an authorization bypass vulnerability allowing authenticated project members to complete another member's DEVELOPMENT environment waitpoint. This bypass occurs by skipping the per-user environment ownership check if the attacker knows the victim's waitpoint friendly ID. The attacker can submit specific waitpoint types with a timeout flag to prematurely mark the waitpoint as completed.
Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.
Trigger.dev versions before 4.6.0 have an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint. This flaw allows users with restricted read:envvars permission to access the environment's root API key (TRIGGER_SECRET_KEY) for staging, production, and preview environments. Exploiting this, attackers can retrieve plaintext secrets, trigger tasks, and mint admin public JWTs, leading to significant privilege escalation.
Trigger.dev versions before 4.6.0 have an authorization bypass vulnerability in the waitpoint token wait endpoint. Authenticated attackers with any secret API key can block runs from other organizations indefinitely by supplying a victim's run ID with their own waitpoint. They can also inject resume data into the victim's run, potentially disrupting workflow execution.
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation history, since the route lacks a secret-key-only check.
Trigger.dev versions before 4.7.0 have an authorization bypass vulnerability that allows users with unrestricted environment API keys to interfere with runs they do not own. By supplying a foreign parentRunId to certain batch-creation API endpoints, attackers can suspend, block indefinitely, or inject errors into production or cross-organization runs.
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
Trigger.dev versions before 4.6.0 contain an authorization bypass vulnerability where the application fails to verify that an authenticated user controls a GitHub App installation before associating it with their organization. This flaw allows attackers to claim another user's GitHub App installation by replaying state cookies and using sequential installation IDs, potentially gaining unauthorized access to the victim's repositories.
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadata endpoints, allowing the server to issue POST requests to restricted resources.
Trigger.dev versions from 4.4.2 up to but not including 4.5.0 contain a path traversal vulnerability in the packet presign routes. This flaw allows a caller-controlled filename to escape the intended restricted directory, enabling unauthorized read or overwrite access to other organizations' offloaded task payloads and outputs in multi-organization self-hosted instances. The vulnerability is fixed in version 4.5.0.
CVE-2026-73658 is a high-severity vulnerability in trigger.dev, a platform for building and deploying AI agents and workflows. Versions from 4.4.2 up to but not including 4.5.0-rc.5 have improper input validation in Aws4FetchClient methods that assign user-controlled keys to URL pathnames. This allows an attacker with a valid environment API key to bypass path normalization and obtain presigned URLs for other tenants' object-store keys, potentially reading or overwriting task payloads. The issue is fixed starting in version 4.5.0-rc.5. The vulnerability involves CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), and CWE-862 (Missing Authorization).
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.
Trigger.dev versions prior to 4.5.6 contain an authorization bypass vulnerability in the background worker deployment API. The flaw allows a user with a valid API key for one project to manipulate deployment identifiers from another project, linking an attacker-controlled background worker to a victim deployment and changing its state from BUILDING to DEPLOYING. This issue is resolved in version 4.5.6.
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the new Google authIdentifier into the existing email-matched account and returns that user object, allowing an attacker-controlled Google profile with an unverified matching email to take over the account. This issue is fixed in version 4.5.2.
Trigger.dev versions prior to 4.5.6 contain a prototype pollution vulnerability in the PUT /api/v1/runs/:runId/metadata endpoint. This flaw allows an attacker with a normal environment API key to modify Object.prototype in the shared webapp process, leading to corruption of Prisma queries and Prometheus labels, breaking authentication for other tenants, and causing a process-wide denial of service. The vulnerability is fixed in version 4.5.6.