CVE-2026-114092
CVE-2026-114092 · Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
CVSS 8.3 · Hoch · EPSS 0,6% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
trigger.dev
- Softwareversionen
- ≥ 0, < 4.5.0: Betroffen (semver)
- 4.5.0: Nicht betroffen (semver)
Auf 4.5.0 aktualisieren
Originalquellen
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-missing-authentication-in-dashboard-run-replay-action
- https://nvd.nist.gov/vuln/detail/CVE-2026-114092