CVE-2026-85651 | BDVDB-2026-368396 Detail
triggerdotdevtrigger.dev
Description#
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://github.com/triggerdotdev/trigger.dev/issues/4173
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qxpp-qjg8-x4jv
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-unauthorized-environment-access-via-run-replay
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.