CVE-2026-114091
CVE-2026-114091 · Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read the victim's task payload.
CVSS 6.0 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.0: Affected (semver)
- 4.5.0: Not affected (semver)
Update to 4.5.0