CVE-2026-114092 triggerdotdev CVE debrief

Who should care

Trigger.dev users and administrators should assess exposure and take remediation steps due to the missing authentication vulnerability in the dashboard run replay action. This vulnerability may impact users who have not upgraded to version 4.5.0 or later, and may expose task payloads or allow unauthorized task execution with victim's secrets. Operators, administrators, and security teams should review their current Trigger.dev deployments and plan for an 4

Why it matters

Trigger.dev users and administrators should assess exposure and take remediation steps due to a missing authentication vulnerability in the dashboard run replay action.

• Potential exposure of task payloads
• Possible unauthorized task execution with victim's secrets
• Need for version upgrade to 4.5.0 or later
• Verification of current Trigger.dev version required

Technical summary

Trigger.dev before 4.5.0 has a missing authentication vulnerability in the dashboard run replay action. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets. This vulnerability allows for potential exposure of sensitive information and unauthorized task execution. Users should upgrade to version 4.5.0 or later to mitigate this vulnerability. The CVE record and NVD entry provide additional details on the vulnerability.

Defensive priority

Trigger.dev users should assess exposure and upgrade to version 4.5.0 or later

Recommended defensive actions

• Assess exposure by checking current Trigger.dev version
• Upgrade to Trigger.dev version 4.5.0 or later
• Review task payloads and secrets for potential exposure
• Verify current Trigger.dev version and check for exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Vendor advisories and a third-party advisory offer additional context. The vulnerability has been publicly disclosed and affects Trigger.dev versions before 4.5.0. Users should verify their current version and consider upgrading to 4.5.0 or later. Additional information can be found in the official CVE Program record and NVD entry.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.