CVE-2026-114092 Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

High 8.3 Published 21 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114092?

CVE-2026-114092 is a high-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.

Official description

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.

Weakness: CWE-306

Which versions are affected by CVE-2026-114092?

How do I fix CVE-2026-114092?

No fix has been published for CVE-2026-114092 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114092 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114092 exists.

Sources

Also known as GHSA-4ggh-4c33-wrjj.