High severity · published Sep 4, 2026
CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
8.5
CVSS
0.5%
EPSS
No
On KEV
Description
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
trigger.dev · triggerdotdev
before 4.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85651
github.com
https://github.com/triggerdotdev/trigger.dev
github.com
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
github.com
https://github.com/triggerdotdev/trigger.dev/issues/4173
github.com
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
github.com
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qxpp-qjg8-x4jv
www.vulncheck.com
https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-unauthorized-environment-access-via-run-replay
More from trigger.dev
9.9
CVE-2026-73656
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
8.8
CVE-2026-114089
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
8.5
CVE-2026-73654
Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
8.3
CVE-2026-114068
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
8.2
CVE-2026-73658
Trigger.dev: Cross-tenant object store read and write via URL path traversal