CVE-2026-114091

MEDIUM 5.3

Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.

CWE	CWE-639
Vendor	triggerdotdev
Product	trigger.dev
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for triggerdotdev trigger.dev

Be the first to know when new medium vulnerabilities affecting triggerdotdev trigger.dev are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

triggerdotdev / trigger.dev

0 < 4.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2 vulncheck.com: https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-cross-tenant-run-payload-disclosure-via-api-replay-route

Credits

🔍 Atomics-hub 🔍 Wernerina 🔍 Solidscripting 🔍 matte1782