CVE-2026-114092

Deferred Deferred - Pending Action

Unauthenticated Run Replay in Trigger.dev

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114092

EUVD

EUVD-2026-106895

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-114092 is a missing authentication vulnerability in Trigger.dev versions before 4.5.0. The application fails to verify user identity or organization membership when handling the dashboard run replay route. Attackers who know a victim's task run friendly ID can replay the task in any environment, exposing the victim's payload or reusing their secrets.

Detection Guidance

Check Trigger.dev versions before 4.5.0 for exposure. Inspect network logs for unauthorized replay requests to the vulnerable routes like resources.taskruns.$runParam.replay or api.v1.runs.$runParam.replay. Look for repeated task executions with mismatched environment IDs.

Impact Analysis

An attacker could access sensitive task payloads, reuse secrets, execute tasks with elevated permissions, consume compute resources, or cause data integrity issues. The attack requires only knowledge of a valid friendly ID, which may be obtained from logs or shared URLs.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security rules. It may result in data breaches, unauthorized processing, or exposure of protected health information, potentially leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.0 or later immediately. Ensure all replay endpoints enforce authentication and authorization checks. Verify environment scoping in ReplayTaskRunService to prevent cross-tenant replay. Monitor for suspicious activity in task execution logs.

Hi! I’m here to help you understand CVE-2026-114092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...