Product by Triggerdotdev

    Trigger.dev

    20 known vulnerabilities in Trigger.dev (Triggerdotdev), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Trigger.dev (Triggerdotdev)
    CriticalCVE-2026-114087

    Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

    		8.1
    HighCVE-2026-114092

    Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

    		6.5
    CriticalCVE-2026-73656

    Triggerdotdev Trigger.dev: Authorization Bypass Through User-Controlled Key

    		9.9
    HighCVE-2026-73654

    Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

    		8.5
    HighCVE-2026-85651

    Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

    		8.5
    HighCVE-2026-73659

    Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

    		8.1
    HighCVE-2026-114082

    Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials

    		8.1
    HighCVE-2026-114085

    Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

    		7.9
    HighCVE-2026-73658

    Trigger.dev: Cross-tenant object store read and write via URL path traversal

    		8.2
    HighCVE-2026-73655

    Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login

    		7.4
    HighCVE-2026-114065

    Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

    		6.5
    HighCVE-2026-114077

    Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

    		7.1
    HighCVE-2026-114067

    Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route

    		6.5
    HighCVE-2026-92773

    Trigger.dev before 4.6.0 GitHub App Installation Takeover

    		7.1
    MediumCVE-2026-114080

    Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

    		5.0
    MediumCVE-2026-114075

    Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

    		5.4
    MediumCVE-2026-114070

    Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

    		3.5
    MediumCVE-2026-85650

    Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

    		5.4
    MediumCVE-2026-114072

    Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State

    		4.3
    MediumCVE-2026-73657

    Trigger.dev: Cross-tenant payload poisoning via packet write + replay

    		4.2

    News

    All products by Triggerdotdev