CVE-2026-114085

Deferred Deferred - Pending Action

Missing Authentication in Trigger.dev Supervisor Workload Server

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114085

EUVD

EUVD-2026-106888

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-114085 is a missing authentication vulnerability in Trigger.dev versions up to 4.7.6. It affects the supervisor workload server, allowing attackers with network access and a valid run or snapshot pair to manipulate runs belonging to other deployments without ownership verification. This includes starting, completing, or suspending runs and accessing resolved environment variables and run JWTs.

Detection Guidance

Monitor network traffic for unauthorized access to the supervisor workload API endpoints like /attempts/start, /attempts/complete, /heartbeat, /suspend, and /continue. Check for unusual HTTP requests targeting these endpoints from unauthorized sources.

Impact Analysis

This vulnerability allows unauthorized users to interfere with workloads across different deployments. Attackers can start or complete runs, disrupt their lifecycle, or steal sensitive data like environment variables and JWTs. This could lead to data breaches, unauthorized access, or service disruptions for affected deployments.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory obligations for data confidentiality and integrity.

Mitigation Strategies

Upgrade trigger.dev to version 4.6.0 or higher to apply the fix for missing authentication. Ensure network access controls are in place to restrict unauthorized access to the supervisor workload API endpoints.

Hi! I’m here to help you understand CVE-2026-114085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...