CVE-2026-114065 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, security teams, and vulnerability management teams should assess exposure and prioritize patching to prevent potential data breaches. Operators managing Trigger.dev instances and platform administrators should verify tenant filtering configurations and monitor for suspicious query activity to mitigate the risk of data exposure.

Why it matters

CVE-2026-114065 is a high-severity vulnerability in Trigger.dev that allows authenticated users to bypass tenant filtering and access data from other tenants. Defenders should prioritize patching to version 4.7.3 or later, verify tenant filtering configurations, and monitor for suspicious query activity to prevent potential data breaches.

• Potential data exposure for multi-tenant environments
• Bypassing of tenant filtering mechanisms
• Exposure of run metadata and payloads
• Requires verification of patch deployment and tenant filtering configurations

Technical summary

The vulnerability in Trigger.dev before version 4.7.3 allows authenticated users to bypass tenant filtering by using placeholder table syntax in POST /api/v1/query requests. This enables attackers to read data from other tenants by submitting queries with FROM {database.table} expressions, including within subqueries, thereby skipping table allowlists and tenant filters. The issue arises from the software's handling of query table placeholders, which can be exploited to expose run metadata and payloads in multi-tenant environments.

Defensive priority

Defenders should prioritize patching to version 4.7.3 or later, verify tenant filtering configurations, and monitor for suspicious query activity.

Recommended defensive actions

• Patch Trigger.dev to version 4.7.3 or later
• Verify tenant filtering configurations
• Monitor for suspicious query activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories. Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. The vulnerability arises from the software's handling of query table placeholders, enabling attackers to submit queries that skip table allowlists and tenant filters, thereby exposing run metadata,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.