CVE-2026-114085 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, especially those with publicly accessible APIs, should assess exposure and prioritize verification of their environments. Security teams and administrators managing Trigger.dev instances should evaluate the vulnerability's impact and implement necessary mitigations.

Why it matters

CVE-2026-114085 is a high-severity vulnerability in Trigger.dev that allows unauthorized manipulation of runs due to missing authentication. Defenders should prioritize verifying exposure, especially for publicly accessible APIs, and assess exploitation feasibility given the network access requirement.

• Potential unauthorized access to environment variables and JWTs
• Manipulation of runs across different deployments
• Possible disruption of service through run suspension or completion
• Need for verification of Trigger.dev version and exposure

Technical summary

The vulnerability exists in the supervisor workload server of Trigger.dev, allowing unauthorized manipulation of runs across different deployments. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs. This issue enables attackers to potentially access unauthorized environment variables and JWTs, and manipulate runs not under their ownership. Defenders should prioritize verifying exposure of Trigger.dev deployments, especially those with publicly accessible APIs, and assess the feasibility of exploitation given the network access requirement.

Defensive priority

Defenders should prioritize verifying exposure of Trigger.dev deployments, especially those with publicly accessible APIs, and assess the feasibility of exploitation given the network access requirement.

Recommended defensive actions

• Verify Trigger.dev version and assess exposure
• Restrict network access to the supervisor workload server
• Implement additional authentication mechanisms for the API
• Monitor for suspicious activity related to run manipulation
• Perform asset inventory of Trigger.dev deployments
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, specific instances of exploitation or detailed victim information are not provided. Defenders should verify Trigger.dev version and exposure, especially for publicly accessible APIs, and assess the feasibility of exploitation given the network access requirement. Evidence is limited to CVE and source item details, with no additional victim or exploitation information available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.