CVE-2026-114092

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092

Versions of Trigger.dev prior to 4.5.0 are vulnerable to a missing authentication vulnerability in the dashboard run replay route (resources.taskruns.$runParam.replay). The root cause is that the action handler performs no authentication or organization check, relying solely on the friendlyId to ...

CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

EUVD-2026-106895

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

PT-2026-120218

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution IDOR vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.1...

NPM: Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

NPM: Trigger.dev: Run replay injects a task run into an attacker-chosen environment cross-tenant write vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

EUVD-2026-71115

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations , allowing authenticated attackers to inject their own task runs into other organizations' or projects' environments. The result is resource consumption on the victim's environment and pollution...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651: Missing Authorization

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

PT-2026-85552

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated attackers can inject task runs into arbitrary environments because the software fails to validate environment membership during run replay operations. This allows attackers to repla...

CVE-2022-25180: Cleartext Transmission of Sensitive Information

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier includes password parameters from the original build in replayed builds, allowing attackers with Run/Replay permission to obtain the values of password parameters passed to previous builds of a Pipeline...