CVE-2026-114068 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments should assess exposure and verify the version in use. They should also monitor for suspicious activity and unauthorized use of secret API keys.

Why it matters

CVE-2026-114068 is a missing authorization vulnerability in Trigger.dev before version 4.6.0 that allows authenticated attackers to block runs belonging to other organizations and inject resume data into them. Defenders should prioritize verifying the version in use, monitoring for suspicious activity, and preventing unauthorized use of secret API keys.

• An attacker can block runs belonging to other organizations, potentially disrupting their workflows.
• An attacker can inject resume data into a victim's run, potentially altering its behavior.
• Defenders need to verify the version of Trigger.dev in use and update to 4.6.0 or later to prevent exploitation.
• Defenders should monitor for unauthorized use of secret API keys to prevent similar attacks.

Technical summary

The vulnerability is located in the waitpoint token wait endpoint of Trigger.dev before version 4.6.0. An authenticated attacker with any secret API key can exploit this vulnerability to block runs belonging to other organizations and inject resume data into them, potentially disrupting workflows and altering behavior. Defenders should prioritize verifying the version of Trigger.dev in use and ensuring it is updated to 4.6.0 or later. They should also review their organization's runs and waitpoints for any suspicious activity and monitor for unauthorized use of secret API keys.

Defensive priority

Defenders should prioritize verifying the version of Trigger.dev in use and ensuring it is updated to 4.6.0 or later. They should also review their organization's runs and waitpoints for any suspicious activity.

Recommended defensive actions

• Verify the version of Trigger.dev in use and update to 4.6.0 or later if necessary.
• Review organization runs and waitpoints for suspicious activity.
• Monitor for unauthorized use of secret API keys.
• Implement additional logging and monitoring to detect potential exploitation attempts.
• Conduct a thorough review of the organization's API keys and ensure they are properly secured.
• Consider implementing compensating controls, such as IP blocking or rate limiting, to prevent exploitation.
• Perform regular security audits to identify and address potential vulnerabilities.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish specific versions affected or fixed beyond 4.6.0, or any exploitation or impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.