CVE-2026-114068

Deferred Deferred - Pending Action

Trigger.dev Missing Authorization in Waitpoint Token Endpoint

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114068

EUVD

EUVD-2026-107019

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trigger.dev before version 4.6.0 has a missing authorization vulnerability in the waitpoint token wait endpoint. Authenticated attackers with any secret API key can block runs belonging to other organizations by supplying a victim run ID with their own waitpoint. This causes the victim's run to block indefinitely on a waitpoint they cannot complete and allows the attacker to inject resume data into it.

Detection Guidance

Check Trigger.dev versions for any installations below 4.6.0. Monitor API logs for suspicious waitpoint token wait endpoint interactions, particularly requests targeting runs not owned by the authenticated user. Look for repeated unauthorized access attempts or blocked runs.

Impact Analysis

If you use Trigger.dev versions before 4.6.0, an attacker with a valid API key could block your organization's workflows indefinitely. This disrupts operations, causes delays, and may lead to data corruption if resume data is injected maliciously. Recovery requires manual intervention.

Compliance Impact

This vulnerability could impact compliance by disrupting data processing workflows, potentially violating availability requirements in GDPR and HIPAA. Unauthorized blocking or data injection may also lead to integrity violations, requiring organizations to address it to maintain regulatory compliance.

Mitigation Strategies

Upgrade Trigger.dev to version 4.6.0 or later immediately. Review and revoke any potentially compromised API keys. Implement strict access controls to validate run ownership in all endpoints. Monitor affected runs for signs of tampering or indefinite blocking.

Hi! I’m here to help you understand CVE-2026-114068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...