CVE-2026-114092

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.0

Description An issue exists where the action handler of the dashboard run replay route does not perform authentication or organization checks. The system retrieves task runs using only the friendlyId variable, allowing a remote attacker who knows this ID to replay a task into an environment of their choosing. This can lead to the exposure of the victim's task payload or the execution of the task using the victim's secrets and API keys. Additionally, a similar issue affects the batch completion endpoint, which allows any authenticated user to trigger completion for any batch ID. The affected endpoints are '/resources/taskruns/$runParam/replay' and '/resources/batches/$batchId/check-completion'.

Recommendations Update Trigger.dev to version 4.5.0 or later. As a temporary workaround, restrict access to the '/resources/taskruns/$runParam/replay' and '/resources/batches/$batchId/check-completion' endpoints.