CVE-2026-114078 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev instances, particularly those with multiple organizations and scheduled tasks, should assess their exposure and prioritize verification and remediation.

Why it matters

CVE-2026-114078 is an authorization bypass vulnerability in Trigger.dev before 4.5.6, allowing authenticated users to delete or disable other organizations' schedules. Defenders should prioritize verifying their Trigger.dev version, reviewing organization schedules, and monitoring for unauthorized changes.

• Authenticated users can delete or disable other organizations' schedules
• Potential disruption to scheduled tasks and workflows
• Requires verification of Trigger.dev version and organization schedules
• Upgrade to 4.5.6 or later to remediate the vulnerability

Technical summary

The vulnerability allows authenticated users to delete or disable other organizations' schedules in Trigger.dev before 4.5.6. This is possible due to an authorization bypass in the DeleteTaskScheduleService and SetActiveOnTaskScheduleService. The issue arises from inadequate access controls, permitting users to manipulate schedules beyond their intended scope. To address this, defenders should focus on verifying their Trigger.dev version, reviewing organization schedules, and monitoring for unauthorized changes. Upgrading to version 4.5.6 or later is crucial to remediate the vulnerability.

Defensive priority

Defenders should prioritize verifying their Trigger.dev version and upgrading to 4.5.6 or later. They should also review their organization's schedules and monitor for unauthorized changes.

Recommended defensive actions

• Verify Trigger.dev version and upgrade to 4.5.6 or later
• Review organization schedules for unauthorized changes
• Monitor schedule changes and implement additional logging or monitoring
• Perform a thorough review of the organization's Trigger.dev instances to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved
• Conduct regular security audits to detect and address similar vulnerabilities in the future

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and organizations is not explicitly stated. The vendor's advisory and other sources provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.