Trigger.dev Environment Replay Task Injection Vulnerability

Executive Summary

CVE-2026-85651 is a vulnerability in Trigger.dev versions before 4.5.2 where authenticated attackers can inject task runs into arbitrary environments by replaying their own runs. The system fails to validate if the target environment belongs to the attacker's organization or project, allowing unauthorized cross-tenant writes. This consumes victim resources and pollutes run history.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Trigger.dev instance is running a version before 4.5.2. Use commands like 'npm list trigger.dev' or 'docker inspect <container_name> | grep trigger.dev' to verify the installed version. Monitor logs for unauthorized run replay attempts or unexpected task executions in environments not owned by the user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to consume your organization's queue and compute resources by injecting unauthorized task runs into your environments. It also pollutes your run history, making it harder to track legitimate operations. Exploitation requires knowing a valid environment ID and task identifier in your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to environments, potentially exposing sensitive data stored or processed in those environments. For GDPR, this may result in unauthorized data processing or access, violating principles of lawfulness and integrity. For HIPAA, it could allow unauthorized access to protected health information, compromising confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Trigger.dev to version 4.5.2 or later. If upgrading is not possible, restrict access to the run replay feature and environment IDs. Review logs for signs of exploitation and revoke any unauthorized task runs. Ensure environment ownership validation is enforced in all replay operations.

Useful 0 Not Useful 0