Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: triggerdotdev trigger.dev — GitHub Security Advisory (GHSA-9fq3-68cw-r7p2) Clear all filters
TI-2026-78705 CVE-2026-114092

Missing authentication in Trigger.dev dashboard run replay action

Priority HIGH 69

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00589 Published 2026-10-21 Fixed in 4.5.0 CWE-306
TI-2026-78704 CVE-2026-114091

Authorization bypass in Trigger.dev replay route exposes run payloads

Priority MEDIUM 60

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00339 Published 2026-10-21 Fixed in 4.5.0 CWE-639