CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114081?
CVE-2026-114081 is a high-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.
Official description
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.
Weakness: CWE-89
Which versions are affected by CVE-2026-114081?
2 open source packages ship an affected version, including trigger.dev.
| Package | Affected | Fixed in |
|---|---|---|
trigger.dev npm | All versions | 4.5.6 |
trigger.dev npm | All versions | 4.5.6 |
How do I fix CVE-2026-114081?
Upgrade trigger.dev to 4.5.6 or later.
Is CVE-2026-114081 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114081 exists.
Sources
Also known as GHSA-9q4r-4842-93vw, GHSA-vmhj-4cqp-m5cj, MINI-8xxr-mwgj-5rcw.