CVE-2026-114092 — Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks…
Published: 2026-10-21 · CVSS: 8.3 · CVSS 4.0
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7