CVE-2026-114068: Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

Q: Which deployments are affected?

Trigger.dev versions before 4.6.0 are affected.

Q: What access does an attacker need?

An attacker needs any valid secret API key. They can use their own waitpoint together with a victim run ID, including for a run belonging to another organization.

Q: What could an attacker do to another organization's run?

They can cause the victim run to wait indefinitely on a waitpoint the victim cannot complete. They can also inject resume data into that run.

Published Oct 21, 2026

Updated

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.6.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Trigger.dev versions before 4.6.0 are affected.

What access does an attacker need?

An attacker needs any valid secret API key. They can use their own waitpoint together with a victim run ID, including for a run belonging to another organization.

What could an attacker do to another organization's run?

They can cause the victim run to wait indefinitely on a waitpoint the victim cannot complete. They can also inject resume data into that run.

CVE-2026-114068: Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What could an attacker do to another organization's run?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

What could an attacker do to another organization's run?