CVE-2026-114084
CVE-2026-114084 · Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
CVSS 8.3 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.6: Affected (semver)
- 4.5.6: Not affected (semver)
Update to 4.5.6