CVE-2026-73657 triggerdotdev CVE debrief

Who should care

Defenders managing Trigger.dev environments, especially those with multiple tenants and untrusted users, should assess exposure and prioritize updating to the fixed version. Defenders should prioritize verifying exposure in Trigger.dev environments, especially those with multiple tenants and untrusted users.

Why it matters

CVE-2026-73657 allows unauthorized replay of task runs across tenants in Trigger.dev, potentially leading to resource consumption and side effect repetition.

• Potential unauthorized consumption of victim resources.
• Possible repetition of side effects in victim environments.
• Potential for payload tampering through separate object-store path-traversal vulnerabilities.

Technical summary

The Trigger.dev platform had a vulnerability allowing unauthorized replay of task runs across tenants due to insufficient filtering in the replay API endpoint. This vulnerability allows unauthorized replay of task runs across tenants in Trigger.dev, potentially leading to resource consumption and side effect repetition. The issue is fixed in version 4.5.0-rc.4. Defenders should prioritize verifying exposure in Trigger.dev environments, especially those with multiple tenants and untrusted users. The vulnerability allows unauthorized replay of task runs across tenants in Trigger.dev, potentially leading to resource consumption and side effect repetition.

Defensive priority

Defenders should prioritize verifying exposure in Trigger.dev environments, especially those with multiple tenants and untrusted users.

Recommended defensive actions

• Verify Trigger.dev environments for exposure, especially those with multiple tenants and untrusted users.
• Update to version 4.5.0-rc.4 or later.
• Monitor for suspicious task run activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence from Trigger.dev and GitHub indicates a vulnerability in Trigger.dev versions 4.4.2 to 4.5.0-rc.4 allowing unauthorized replay of task runs across tenants. The vulnerability allows unauthorized replay of task runs across tenants in Trigger.dev, potentially leading to resource consumption and side effect repetition. This issue is fixed in version 4.5.0-rc.4.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.