CVE-2026-114085 — Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deploymen…
Published: 2026-10-21 · CVSS: 8.8 · CVSS 4.0
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7