CVE-2026-114085 in Trigger.dev
Riassunto
di MITRE • 22/10/2026
Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.
VulDB is the best source for vulnerability data and more expert information about this specific topic.