TR
Product
trigger.dev
37
CVEs
0
On KEV
9.9
Max CVSS
28
New 30D
Severity mix
Critical 1High 18Medium 16Low 2
Watch
Add trigger.dev to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-73656 | 9.9 | Aug 13 | Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state Affected: < 4.5.2 |
| CVE-2026-114089 | 8.8 | Oct 21 | Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover Affected: before 4.5.2 |
| CVE-2026-85651 | 8.5 | Sep 4 | Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay Affected: before 4.5.2 |
| CVE-2026-73654 | 8.5 | Aug 13 | Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS Affected: >= 3.3.8, < 4.5.6 |
| CVE-2026-114068 | 8.3 | Oct 21 | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint Affected: before 4.6.0 |
| CVE-2026-73658 | 8.2 | Aug 13 | Trigger.dev: Cross-tenant object store read and write via URL path traversal Affected: >= 4.4.2, < 4.5.0-rc.5 |
| CVE-2026-114087 | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets Affected: before 4.5.6 |
| CVE-2026-114083 | 8.1 | Oct 21 | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints Affected: before 4.5.0-rc.3 |
| CVE-2026-114082 | 8.1 | Oct 21 | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials Affected: before 4.6.2 |
| CVE-2026-114078 | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup Affected: before 4.5.6 |
| CVE-2026-114069 | 8.1 | Oct 21 | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint Affected: before 4.6.0 |
| CVE-2026-114066 | 8.1 | Oct 21 | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints Affected: before 4.7.0 |
| CVE-2026-73659 | 8.1 | Aug 13 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API Affected: >= 4.4.2, < 4.5.0 |
| CVE-2026-114085 | 7.9 | Oct 21 | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API Affected: through 4.7.6 |
| CVE-2026-114084 | 7.7 | Oct 21 | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API Affected: before 4.5.6 |
| CVE-2026-114081 | 7.7 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name Affected: before 4.5.6 |
| CVE-2026-73655 | 7.4 | Aug 13 | Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login Affected: < 4.5.2 |
| CVE-2026-114077 | 7.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 Affected: before 4.5.6 |
| CVE-2026-92773 | 7.1 | Sep 16 | Trigger.dev before 4.6.0 GitHub App Installation Takeover Affected: before 4.6.0 |
| CVE-2026-114092 | 6.5 | Oct 21 | Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action Affected: before 4.5.0 |
| CVE-2026-114088 | 6.5 | Oct 21 | Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO Affected: before 4.5.4 |
| CVE-2026-114067 | 6.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route Affected: 4.5.0 before 4.6.2 |
| CVE-2026-114065 | 6.5 | Oct 21 | Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders Affected: before 4.7.3 |
| CVE-2026-114073 | 5.5 | Oct 21 | Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs Affected: before 4.5.9 |
| CVE-2026-114079 | 5.4 | Oct 21 | Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint Affected: before 4.5.6 |
| CVE-2026-114076 | 5.4 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL Affected: before 4.5.2 |
| CVE-2026-114075 | 5.4 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API Affected: before 4.5.12 |
| CVE-2026-114074 | 5.4 | Oct 21 | Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range Affected: before 4.5.10 |
| CVE-2026-85650 | 5.4 | Sep 4 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel Affected: before 4.5.2 |
| CVE-2026-114091 | 5.3 | Oct 21 | Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route Affected: before 4.5.0 |
| CVE-2026-114086 | 5.3 | Oct 21 | Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint Affected: before 4.5.5 |
| CVE-2026-114080 | 5.0 | Oct 21 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL Affected: before 4.5.2 |
| CVE-2026-114093 | 4.3 | Oct 21 | Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint Affected: before 4.5.6 |
| CVE-2026-114072 | 4.3 | Oct 21 | Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State Affected: before 4.5.12 |
| CVE-2026-73657 | 4.2 | Aug 13 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay Affected: >= 4.4.2, < 4.5.0-rc.4 |
| CVE-2026-114070 | 3.5 | Oct 21 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records Affected: 4.5.0 before 4.6.0 |
| CVE-2026-114071 | 3.1 | Oct 21 | Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route Affected: before 4.5.12 |
Showing 37