CVE-2026-114085

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.7.7

Description The supervisor workload server lacks proper authentication, allowing workloads to manipulate runs from other deployments without ownership verification. An attacker with network access and a valid run/snapshot pair can access the 'attempts/start' endpoint to retrieve resolved environment variables and run JWTs (JSON Web Tokens, which are used for secure transmission of information between parties). Additionally, this allows the attacker to start, complete, or suspend runs belonging to other tenants.

Recommendations Update to version 4.7.7 or later.