CVE-2026-114072 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev instances, especially those with Slack OAuth integrations, should assess exposure and prioritize upgrading to version 4.5.12 or later. They should also verify exposure of Trigger.dev instances, monitor for suspicious activity, and review compensating controls for exposed systems.

Why it matters

The CSRF vulnerability in Trigger.dev before 4.5.12 allows attackers to trick authenticated members into connecting an attacker-controlled Slack workspace, potentially leading to unauthorized access to operational alerts.

• Defenders must verify exposure of Trigger.dev instances to potential CSRF attacks
• Upgrading to version 4.5.12 or later can prevent exploitation
• Monitoring for suspicious activity on Trigger.dev instances is necessary

Technical summary

The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts. The vulnerability is due to the organization-level Slack OAuth flow using the organization ID as the OAuth state without binding it to the initiating session. This allows attackers to potentially gain unauthorized access to operational alerts.

Defensive priority

Defenders should prioritize verifying exposure of Trigger.dev instances, especially those with Slack OAuth integrations, and upgrade to version 4.5.12 or later.

Recommended defensive actions

• Verify exposure of Trigger.dev instances, especially those with Slack OAuth integrations
• Upgrade to version 4.5.12 or later
• Monitor for suspicious activity on Trigger.dev instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the CSRF vulnerability in Trigger.dev before 4.5.12. The vulnerability is in the organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.