What’s Vulnerable › Products

triggerdotdev trigger.dev vulnerabilities

37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 37 published in the last 12 months.

Check whether your triggerdotdev trigger.dev version is affected

Latest triggerdotdev trigger.dev vulnerabilities

• CVE-2026-114093 — Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint (CVSS 4.3)
• CVE-2026-114092 — Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action (CVSS 6.5)
• CVE-2026-114091 — Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route (CVSS 5.3)
• CVE-2026-114089 — Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover (CVSS 8.8)
• CVE-2026-114088 — Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO (CVSS 6.5)
• CVE-2026-114087 — Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets (CVSS 8.1)
• CVE-2026-114086 — Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint (CVSS 5.3)
• CVE-2026-114085 — Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API (CVSS 7.9)
• CVE-2026-114084 — Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API (CVSS 7.7)
• CVE-2026-114083 — Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints (CVSS 8.1)
• CVE-2026-114082 — Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials (CVSS 8.1)
• CVE-2026-114081 — Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name (CVSS 7.7)
• CVE-2026-114080 — Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL (CVSS 5.0)
• CVE-2026-114079 — Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint (CVSS 5.4)
• CVE-2026-114078 — Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup (CVSS 8.1)
• CVE-2026-114077 — Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 (CVSS 7.1)
• CVE-2026-114076 — Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL (CVSS 5.4)
• CVE-2026-114075 — Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API (CVSS 5.4)
• CVE-2026-114074 — Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range (CVSS 5.4)
• CVE-2026-114073 — Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs (CVSS 5.5)
• CVE-2026-114072 — Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State (CVSS 4.3)
• CVE-2026-114071 — Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route (CVSS 3.1)
• CVE-2026-114070 — Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records (CVSS 3.5)
• CVE-2026-114069 — Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint (CVSS 8.1)
• CVE-2026-114068 — Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint (CVSS 8.3)