TR
Product
trigger.dev
37
CVEs
0
On KEV
9.9
Max CVSS
28
New 30D
Severity mix
Critical 1High 18Medium 16Low 2
Watch
Add trigger.dev to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-114089 | 8.8 | Oct 21 | Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover Affected: before 4.5.2 |
| CVE-2026-85651 | 8.5 | Sep 4 | Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay Affected: before 4.5.2 |
| CVE-2026-73654 | 8.5 | Aug 13 | Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS Affected: >= 3.3.8, < 4.5.6 |
| CVE-2026-114068 | 8.3 | Oct 21 | Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint Affected: before 4.6.0 |
| CVE-2026-73658 | 8.2 | Aug 13 | Trigger.dev: Cross-tenant object store read and write via URL path traversal Affected: >= 4.4.2, < 4.5.0-rc.5 |
| CVE-2026-114087 | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets Affected: before 4.5.6 |
| CVE-2026-114083 | 8.1 | Oct 21 | Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints Affected: before 4.5.0-rc.3 |
| CVE-2026-114082 | 8.1 | Oct 21 | Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials Affected: before 4.6.2 |
| CVE-2026-114078 | 8.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup Affected: before 4.5.6 |
| CVE-2026-114069 | 8.1 | Oct 21 | Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint Affected: before 4.6.0 |
| CVE-2026-114066 | 8.1 | Oct 21 | Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints Affected: before 4.7.0 |
| CVE-2026-73659 | 8.1 | Aug 13 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API Affected: >= 4.4.2, < 4.5.0 |
| CVE-2026-114085 | 7.9 | Oct 21 | Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API Affected: through 4.7.6 |
| CVE-2026-114084 | 7.7 | Oct 21 | Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API Affected: before 4.5.6 |
| CVE-2026-114081 | 7.7 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name Affected: before 4.5.6 |
| CVE-2026-73655 | 7.4 | Aug 13 | Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login Affected: < 4.5.2 |
| CVE-2026-114077 | 7.1 | Oct 21 | Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 Affected: before 4.5.6 |
| CVE-2026-92773 | 7.1 | Sep 16 | Trigger.dev before 4.6.0 GitHub App Installation Takeover Affected: before 4.6.0 |
Showing 18