CVE-2026-114084
Deferred Deferred - Pending Action

SQL Injection in Trigger.dev Prior to 4.5.6

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-28
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-114084
EUVD
EUVD-2026-106887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
triggerdotdev trigger.dev 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114084 is a SQL injection vulnerability in Trigger.dev versions before 4.5.6. It affects the /realtime/v1/runs endpoint where the unescaped tags query parameter is concatenated into a SQL WHERE clause without proper escaping. This allows authenticated attackers with a project API key and read:runs scope to inject boolean conditions and bypass tenant isolation, enabling them to read TaskRun records from other organizations on the same self-hosted instance.

Detection Guidance

To detect this vulnerability, check if your trigger.dev instance is running a version before 4.5.6. Inspect API logs for suspicious requests to the /realtime/v1/runs endpoint with unusual tags parameters. Look for boolean injection patterns like x'] OR true -- in query strings.

Impact Analysis

If you are using Trigger.dev versions before 4.5.6 on a self-hosted instance, an attacker with a valid project API key and read access could exploit this to access sensitive TaskRun records, including payloads and metadata, from other organizations sharing the same instance. This could lead to unauthorized data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade trigger.dev to version 4.5.6 or later immediately. Revoke and regenerate all project API keys with read:runs scope as a precaution. Review logs for any signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...