CVE-2026-85651

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2

Description Authenticated attackers can inject task runs into arbitrary environments because the software fails to validate environment membership during run replay operations. This allows attackers to replay their own runs into environments belonging to other organizations or projects, resulting in the consumption of victim resources and the pollution of run history.

Recommendations Update to version 4.5.2 or later.