CVE-2026-114091 triggerdotdev CVE debrief

Who should care

Trigger.dev administrators and users, security teams, and operators should be aware of this vulnerability. They should assess exposure, verify patching to prevent unauthorized access, and monitor for suspicious activity. This includes reviewing and updating incident response plans, verifying Trigger.dev version, and applying patches if vulnerable. Security teams should also review compensating controls for exposed systems while remediation is scheduled and

Why it matters

CVE-2026-114091 allows attackers to replay runs into their own environment and read victim task payloads using a victim's run friendlyId and any tenant's API key. Trigger.dev administrators and users should assess exposure, verify patching, and monitor for suspicious activity.

• Verify patching to prevent unauthorized access to task payloads
• Assess exposure to API replay attacks
• Monitor for suspicious API activity
• Update incident response plans

Technical summary

Trigger.dev before 4.5.0 is vulnerable to cross-tenant run payload disclosure via an API replay route. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload. The vulnerability has a CVSS score of 6 and a severity of MEDIUM. Trigger.dev administrators and users should assess exposure, verify patching, and monitor for suspicious activity to mitigate potential impacts. The vulnerability is confirmed by official CVE Program and NVD records.

Defensive priority

Assess exposure and verify patching for Trigger.dev versions before 4.5.0

Recommended defensive actions

• Assess exposure of Trigger.dev instances to API replay attacks
• Verify Trigger.dev version and apply patch 4.5.0 or later if vulnerable
• Monitor for suspicious API activity
• Review and update incident response plans
• Verify patching to prevent unauthorized access to task payloads
• Assess exposure and verify patching for Trigger.dev versions before 4.5.0
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

Official CVE Program and NVD records confirm Trigger.dev vulnerability. The CVE record was published on 2026-10-21T00:36:56.273Z and has not been modified since then. The NVD entry is currently Medium. Evidence is limited to CVE Program and NVD records; further verification is recommended to assess exposure and validate patching. Defenders should verify patching to prevent unauthorized access to task payloads and monitor for suspicious API activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.