npm trigger.dev vulnerabilities

Latest npm trigger.dev CVEs

Newest publication first

1. CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

   Published 2026-10-21

   High·CVSS 8.3 EPSS 0.59%

   Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it in...

2. CVE-2026-114088 Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

   Published 2026-10-21

   High·CVSS 8.3 EPSS 0.40%

   Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run envir...

3. CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

   Published 2026-10-21

   Critical·CVSS 9.2 EPSS 0.51%

   Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any em...

4. CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

   Published 2026-10-21

   Medium·CVSS 6.9 EPSS 0.38%

   Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run fr...

5. CVE-2026-114085 Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

   Published 2026-10-21

   High·CVSS 8.8 EPSS 0.19%

   Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call...

6. CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

   Published 2026-10-21

   High·CVSS 8.3 EPSS 0.40%

   Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/qu...

7. CVE-2026-114079 Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

   Published 2026-10-21

   Medium·CVSS 5.3 EPSS 0.30%

   Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or...

8. CVE-2026-114078 Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

   Published 2026-10-21

   High·CVSS 7.2 EPSS 0.42%

   Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their...

9. CVE-2026-114077 Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

   Published 2026-10-21

   Medium·CVSS 6.1 EPSS 0.35%

   Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST...

10. CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

    Published 2026-10-21

    Medium·CVSS 5.3 EPSS 0.33%

    Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal se...

11. CVE-2026-114074 Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

    Published 2026-10-21

    Medium·CVSS 5.3 EPSS 0.36%

    Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at int...

12. CVE-2026-114073 Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

    Published 2026-10-21

    Medium·CVSS 6.8 EPSS 0.23%

    Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the...

13. CVE-2026-114065 Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

    Published 2026-10-21

    High·CVSS 7.1 EPSS 0.36%

    Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within sub...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.