Trigger.dev (Triggerdotdev) - vulnerabilities (CVEs)

37 CVEs, 28 in the last 30 days, 1 known versions, newest CVE from 2026-10-21. Vendor: Triggerdotdev.

CVEs of Trigger.dev

CVE-2026-114093 - CVSS 5.3 (medium), 2026-10-21: Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to…
CVE-2026-114092 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route…
CVE-2026-114091 - CVSS 6 (medium), 2026-10-21: Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime…
CVE-2026-114089 - CVSS 8.8 (high), 2026-10-21: Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading…
CVE-2026-114088 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to…
CVE-2026-114087 - CVSS 9.2 (critical), 2026-10-21: Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because…
CVE-2026-114086 - CVSS 6.9 (medium), 2026-10-21: Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject…
CVE-2026-114085 - CVSS 8.8 (high), 2026-10-21: Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging…
CVE-2026-114084 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into…
CVE-2026-114083 - CVSS 8.6 (high), 2026-10-21: Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to…
CVE-2026-114082 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2…
CVE-2026-114081 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated…
CVE-2026-114080 - CVSS 5.3 (medium), 2026-10-21: Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests…
CVE-2026-114079 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other…
CVE-2026-114078 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows…
CVE-2026-114077 - CVSS 7.1 (high), 2026-10-21: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId…
CVE-2026-114076 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST…
CVE-2026-114075 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create alert…
CVE-2026-114074 - CVSS 5.4 (medium), 2026-10-21: Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by…
CVE-2026-114073 - CVSS 6.8 (medium), 2026-10-21: Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by…
CVE-2026-114072 - CVSS 5.3 (medium), 2026-10-21: The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the…
CVE-2026-114071 - CVSS 3.1 (low), 2026-10-21: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT…
CVE-2026-114070 - CVSS 5.1 (medium), 2026-10-21: Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in…
CVE-2026-114069 - CVSS 8.6 (high), 2026-10-21: Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the…
CVE-2026-114068 - CVSS 8.3 (high), 2026-10-21: Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs…
CVE-2026-114067 - CVSS 7.1 (high), 2026-10-21: Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token…
CVE-2026-114066 - CVSS 8.1 (high), 2026-10-21: Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own…
CVE-2026-114065 - CVSS 7.1 (high), 2026-10-21: Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder…
CVE-2026-92773 - CVSS 7.1 (high), 2026-09-16: Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can…
CVE-2026-85651 - CVSS 8.5 (high), 2026-09-04: Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs…
CVE-2026-85650 - CVSS 5.4 (medium), 2026-09-04: Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or…
CVE-2026-73659 - CVSS 8.1 (high), 2026-08-13: Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in…
CVE-2026-73658 - CVSS 8.2 (high), 2026-08-13: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and…
CVE-2026-73657 - CVSS 4.2 (medium), 2026-08-13: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay`…
CVE-2026-73656 - CVSS 9.9 (critical), 2026-08-13: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST…
CVE-2026-73655 - CVSS 7.4 (high), 2026-08-13: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in…
CVE-2026-73654 - CVSS 8.5 (high), 2026-08-13: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata…