CVE-2026-114066

Deferred Deferred - Pending Action

Missing Authorization in Trigger.dev Allows Run Blocking

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114066

EUVD

EUVD-2026-107017

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-114066 is a missing authorization vulnerability in Trigger.dev versions before 4.7.0. It allows attackers with unrestricted environment API keys to block or disrupt runs they do not own by supplying a foreign parentRunId to batch-creation endpoints like POST /api/v3/batches or POST /api/v2/tasks/batch. The endpoints do not verify if the parent run belongs to the caller's environment, enabling cross-organization attacks.

Detection Guidance

Monitor API logs for POST requests to /api/v3/batches or /api/v2/tasks/batch with resumeParentOnCompletion and a foreign parentRunId. Check for runs transitioning to SUSPENDED or EXECUTING_WITH_WAITPOINTS states without user action.

Impact Analysis

This vulnerability can lead to suspended runs, indefinite blocking, or forced errors in production or cross-organization workflows. Attackers may disrupt critical processes, cause downtime, or inject errors into systems you rely on, potentially affecting business operations and data integrity.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access or disruption of sensitive data processing runs. Attackers could suspend or block runs indefinitely, leading to unauthorized modifications or disruptions in data handling workflows. This may violate principles of data integrity, availability, and access control required by these regulations.

Mitigation Strategies

Upgrade trigger.dev to version 4.7.0 or later. Rotate all unrestricted environment API keys and replace them with restricted keys. Review and block any POST requests to affected endpoints with suspicious parentRunId values.

Hi! I’m here to help you understand CVE-2026-114066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...