Trigger.dev: Missing authentication in dashboard run replay
Summary
Trigger.dev before 4.5.0 lets a remote attacker replay a task run by its friendlyId alone, without authentication or an organization check. The replay is executed in an environment the attacker chooses. An attacker who knows or obtains a victim's run friendlyId can read the task payload or run the task again with the victim's secrets. Exploitation is targeted, because the attacker needs the friendlyId.
Affected
- Trigger.dev versions before 4.5.0 (CVE record, VulnCheck)
- GHSA-pp95-gc86-jq6q lists <= 4.5.1; the sources do not explain the difference from 4.5.0
- Self-hosted instances are the main concern
Fixed in
- Upgrade to Trigger.dev 4.5.2 or later (both GHSA advisories list 4.5.2 as patched)
- The CVE record only states 'before 4.5.0', so confirm the exact fixed version in the release notes
Workaround
- No vendor workaround documented.
- Restrict dashboard access to trusted networks or VPN until patched.
- Review run history for unexpected replays into other environments.
- Rotate secrets used by tasks if replay activity is found or cannot be ruled out.
Exploitation
- CISA SSVC: exploitation 'poc' (proof of concept available), automatable: no, technical impact: partial.
- No evidence of exploitation in the wild found in the sources.
Our recommendation
- Upgrade to Trigger.dev 4.5.2 or later as soon as possible.
- Until then, limit dashboard exposure to trusted networks.
- Check run history and logs for unexpected replays and rotate secrets if in doubt.
- Note that the CVSS severity differs between sources (NVD CVSS 4.0: 8.3; some aggregators: 6.5). Plan using 8.3.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Advisory GHSA-9fq3-68cw-r7p2 github.com
- GitHub Advisory GHSA-pp95-gc86-jq6q github.com
- VulnCheck advisory for Trigger.dev before 4.5.0 www.vulncheck.com
- VulDB entry CVE-2026-114092 vuldb.com
- Mend entry CVE-2026-114092 vulners.com
- OSV GHSA-pp95-gc86-jq6q osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:24.
Original description (NVD)
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
NVD references (5)
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-missing-authentication-in-dashboard-run-replay-…
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.