CVE-2026-114092
6.5 MEDIUMpublic exploit availablePublished 2026-10-21 · Updated 2026-10-22
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-306
Public exploit & PoC references
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
All references
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.0-missing-authentication-in-dashboard-run-replay-action
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9fq3-68cw-r7p2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pp95-gc86-jq6q
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-5563
- UNSCOREDCVE-2025-30043
- UNSCOREDCVE-2025-30053
- CRITICALCVE-2025-70516
- MEDIUMCVE-2026-100192PoC
- UNSCOREDCVE-2026-100406PoC
- HIGHCVE-2026-100672PoC
- HIGHCVE-2026-100746PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.