CVE-2026-114091

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.0

Description An issue exists where the system looks up runs using only the friendlyId in the 'api.v1.runs.$runParam.replay' endpoint without restricting the search to the caller's runtime environment. This allows an attacker with a valid API key from any tenant who knows a victim's friendlyId to replay that run into their own environment and access the victim's task payload.

Recommendations Update to version 4.5.0 or later.