Trigger.dev Run Replay Vulnerability Allows Unauthorized Access

Executive Summary

CVE-2026-114091 is a cross-tenant task replay vulnerability in trigger.dev versions before 4.5.0. It occurs because replay endpoints use a run's friendlyId without scoping it to the caller's runtime environment. An attacker with any tenant's API key who knows a victim's run friendlyId can replay that run in their own environment and access the victim's task payload.

Useful 0 Not Useful 0

Detection Guidance

Check if your trigger.dev instance is running a version before 4.5.0. Review API logs for unauthorized replay requests using victim run friendlyIds. Inspect network traffic for suspicious API calls to api.v1.runs.$runParam.replay with external environment IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive task payloads from other tenants by replaying runs in their own environment. It may lead to data disclosure, integrity issues if victim environments are targeted, and potential billing impacts from repeated replays. Attackers need knowledge of the victim's friendlyId, which could be obtained through webhook bodies, error logs, or shared dashboard URLs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive task payloads, potentially exposing personal or health data. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it risks unauthorized disclosure of protected health information if task payloads contain such data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade trigger.dev to version 4.5.0 or later immediately. Review and revoke any potentially compromised API keys. Audit recent replay operations for unauthorized access. Implement additional environment scoping checks if custom deployments exist.

Useful 0 Not Useful 0