Vulnerability · Published Oct 21, 2026 · Assigned by VulnCheck

CVE-2026-114092Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Medium 6.5

In plain English

A medium-severity missing authentication in trigger.dev from triggerdotdev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 51.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.

Affected products (as reported)

Vendor	Product	Versions
triggerdotdev	trigger.dev	0 – before 4.5.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-pp95-gc86-jq6q) vendor-advisory
GitHub Security Advisory (GHSA-9fq3-68cw-r7p2) vendor-advisory
VulnCheck Advisory: Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action third-party-advisory