CVE-2026-114071 Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114071?
CVE-2026-114071 is a low-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.
Official description
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.
Weakness: CWE-862
Which versions are affected by CVE-2026-114071?
How do I fix CVE-2026-114071?
No fix has been published for CVE-2026-114071 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114071 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114071 exists.
Sources
Also known as GHSA-3p6g-7xq3-87rv, GHSA-m8pr-xr7c-frh3.