CVE-2026-114065: Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

Q: Which deployments are affected?

Trigger.dev versions before 4.7.3 are affected. The issue applies to the POST /api/v1/query endpoint.

Q: What access does an attacker need?

An attacker needs an authenticated user account with low-level privileges. No user interaction is required, and the attack can be performed over the network.

Q: What data could be exposed?

An attacker may read data belonging to other tenants, including run metadata and payloads. The provided information describes a confidentiality impact and does not identify integrity or availability impact.

Q: How is the tenant filtering bypass triggered?

The attacker submits a query using placeholder table syntax such as FROM {database.table}, including in subqueries. This can bypass the table allowlist and tenant filters.

Published Oct 21, 2026

Updated

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.7.3

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Trigger.dev versions before 4.7.3 are affected. The issue applies to the POST /api/v1/query endpoint.

What access does an attacker need?

An attacker needs an authenticated user account with low-level privileges. No user interaction is required, and the attack can be performed over the network.

What data could be exposed?

An attacker may read data belonging to other tenants, including run metadata and payloads. The provided information describes a confidentiality impact and does not identify integrity or availability impact.

How is the tenant filtering bypass triggered?

The attacker submits a query using placeholder table syntax such as FROM {database.table}, including in subqueries. This can bypass the table allowlist and tenant filters.

CVE-2026-114065: Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What data could be exposed?

How is the tenant filtering bypass triggered?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What data could be exposed?

How is the tenant filtering bypass triggered?