CVE-2026-114084

HIGH 7.7

Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.

CWE	CWE-89
Vendor	triggerdotdev
Product	trigger.dev
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for triggerdotdev trigger.dev

Be the first to know when new high vulnerabilities affecting triggerdotdev trigger.dev are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

triggerdotdev / trigger.dev

0 < 4.5.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-p6j2-2fjh-vc8v vulncheck.com: https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-sql-injection-via-tags-in-realtime-runs-api

Credits

🔍 kah-ja 🔍 daniel-mertz