CVE-2026-114066: Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Q: Who can exploit this issue?

An attacker needs an unrestricted environment API key. The issue can affect production or cross-organization runs when the attacker can submit a foreign parentRunId to the affected batch-creation endpoints.

Q: Which API requests are involved?

The affected requests are POST /api/v3/batches and POST /api/v2/tasks/batch when resumeParentOnCompletion is used. Supplying a parentRunId for a run the caller does not own can create a waitpoint for that run.

Q: What is the operational impact of successful exploitation?

An attacker can suspend or indefinitely block targeted runs, and can inject errors into them. The vulnerability affects integrity and availability; no confidentiality impact is indicated by the provided severity vector.

Q: What version addresses the issue?

Trigger.dev versions before 4.7.0 are affected. Upgrade to version 4.7.0 or later.

Published Oct 21, 2026

Updated

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev to a version that resolves this vulnerability.
Fixed in 4.7.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an unrestricted environment API key. The issue can affect production or cross-organization runs when the attacker can submit a foreign parentRunId to the affected batch-creation endpoints.

Which API requests are involved?

The affected requests are POST /api/v3/batches and POST /api/v2/tasks/batch when resumeParentOnCompletion is used. Supplying a parentRunId for a run the caller does not own can create a waitpoint for that run.

What is the operational impact of successful exploitation?

An attacker can suspend or indefinitely block targeted runs, and can inject errors into them. The vulnerability affects integrity and availability; no confidentiality impact is indicated by the provided severity vector.

What version addresses the issue?

Trigger.dev versions before 4.7.0 are affected. Upgrade to version 4.7.0 or later.

CVE-2026-114066: Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which API requests are involved?

What is the operational impact of successful exploitation?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which API requests are involved?

What is the operational impact of successful exploitation?

What version addresses the issue?