CVE-2026-114084 in Trigger.dev
Summary
by MITRE • 10/22/2026
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Trigger.dev versions prior to 4.5.6 represents a critical security flaw rooted in improper neutralization of special elements used in an SQL command, commonly classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. This specific instance manifests within the /realtime/v1/runs endpoint, which is designed to facilitate real-time data streaming for task execution records. The core technical failure lies in how the application handles input validation and query construction. Specifically, the tags query parameter is directly concatenated into the ElectricSQL shape where clause without adequate sanitization or parameterization. This lack of proper encoding allows an attacker to inject arbitrary SQL logic that alters the intended behavior of the database query engine.
The operational impact of this vulnerability is severe due to a concurrent failure in access control mechanisms, specifically regarding tenant isolation on self-hosted instances. The application relies on a runtimeEnvironmentId guard to ensure that users can only access data belonging to their specific organization or project. However, by exploiting the SQL injection vector through boolean condition appending, an authenticated attacker with read:runs scope can bypass this tenant guard entirely. This means that even if the user is authorized to view runs for one specific project, they can manipulate the query structure to remove or weaken the filtering conditions associated with their own environment ID. Consequently, the database returns records from all organizations hosted on the same instance rather than just the permitted ones.
This flaw effectively results in a complete breakdown of multi-tenancy security boundaries. An attacker possessing any valid project API key with read:runs privileges can enumerate and exfiltrate sensitive data across the entire infrastructure. The scope of accessible information includes TaskRun records, which often contain payloads and metadata that may hold proprietary business logic, internal system states, or potentially personally identifiable information depending on the application's usage patterns. This aligns with ATT&CK technique T1078: Valid Accounts, as it leverages legitimate credentials to perform unauthorized data access, and T1530: Data from Cloud Storage Object, insofar as it involves extracting structured data stored within a database service that functions similarly to cloud storage for application state.
Mitigation strategies must prioritize immediate patching of the Trigger.dev software to version 4.5.6 or later, where this concatenation issue has been resolved through proper parameterized queries and enhanced input validation. For organizations unable to upgrade immediately due to dependency constraints, network-level controls such as Web Application Firewalls may offer partial mitigation by detecting common SQL injection patterns in query parameters, though this is not a reliable long-term solution given the sophistication of boolean-based blind injections. Additionally, reviewing API key permissions ensures that only essential scopes are granted, reducing the attack surface for potential exploitation. Regular security audits focusing on database interaction layers and strict enforcement of tenant isolation logic during code reviews are recommended to prevent similar architectural flaws in future development cycles.