CVE-2026-114084

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6

Description An SQL injection issue exists in the '/realtime/v1/runs' endpoint. The system concatenates the unescaped tags query parameter into the ElectricSQL shape where clause, which bypasses the runtimeEnvironmentId tenant guard. Authenticated attackers with a project API key possessing the read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from all organizations sharing the same self-hosted instance.

Recommendations Update to version 4.5.6 or later. Avoid using the tags parameter in the '/realtime/v1/runs' endpoint until the update is applied.