Triggerdotdev Trigger.dev vulnerabilities

• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint CVE-2026-114093 5.3 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action CVE-2026-114092 8.3 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route CVE-2026-114091 6.0 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover CVE-2026-114089 8.7 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API CVE-2026-114085 8.8 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API CVE-2026-114084 8.3 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints CVE-2026-114083 8.6 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials CVE-2026-114082 7.2 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL CVE-2026-114080 5.3 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup CVE-2026-114078 7.2 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 CVE-2026-114077 6.1 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API CVE-2026-114075 5.3 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range CVE-2026-114074 5.3 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State CVE-2026-114072 5.3 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route CVE-2026-114071 2.3 LowOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records CVE-2026-114070 5.1 MediumOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint CVE-2026-114069 8.6 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint CVE-2026-114068 7.2 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route CVE-2026-114067 7.1 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints CVE-2026-114066 7.2 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders CVE-2026-114065 7.1 HighOctober 21, 2026
• triggerdotdev trigger.dev Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs CVE-2026-114073 Fix available 6.8 MediumOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint CVE-2026-114079 Fix available 5.3 MediumOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name CVE-2026-114081 Fix available 8.3 HighOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint CVE-2026-114086 Fix available 6.9 MediumOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets CVE-2026-114087 Fix available 9.2 CriticalOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO CVE-2026-114088 Fix available 8.3 HighOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL CVE-2026-114076 Fix available 5.3 MediumOctober 2, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.6.0 GitHub App Installation Takeover CVE-2026-92773 7.1 HighSeptember 16, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay CVE-2026-85651 Fix available 8.4 HighSeptember 4, 2026
• triggerdotdev trigger.dev Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel CVE-2026-85650 Fix available 5.3 MediumSeptember 4, 2026
• triggerdotdev trigger.dev Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API CVE-2026-73659 8.1 HighAugust 13, 2026
• triggerdotdev trigger.dev Trigger.dev: Cross-tenant object store read and write via URL path traversal CVE-2026-73658 8.2 HighAugust 13, 2026
• triggerdotdev trigger.dev Trigger.dev: Cross-tenant payload poisoning via packet write + replay CVE-2026-73657 4.2 MediumAugust 13, 2026
• triggerdotdev trigger.dev Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state CVE-2026-73656 9.9 CriticalAugust 13, 2026
• triggerdotdev trigger.dev Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login CVE-2026-73655 7.4 HighAugust 13, 2026
• triggerdotdev trigger.dev Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS CVE-2026-73654 Fix available 8.5 HighAugust 13, 2026