Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: triggerdotdev trigger.dev 4.6.0 Clear all filters
TI-2026-78683 CVE-2026-114070

Trigger.dev Dashboard leaks user tokens in session records

Priority LOW 23

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00298 Published 2026-10-21 Fixed in 4.6.0 CWE-522
TI-2026-78682 CVE-2026-114069

Improper authorization in Trigger.dev exposes root API key via envvars endpoint

Priority HIGH 72

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, producti…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00374 Published 2026-10-21 Fixed in 4.6.0 CWE-269
TI-2026-78681 CVE-2026-114068

Missing authorization in Trigger.dev waitpoint token wait endpoint

Priority HIGH 65

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00366 Published 2026-10-21 Fixed in 4.6.0 CWE-639