CVE-2026-114081: Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Q: Who can exploit this issue?

An authenticated Trigger.dev customer can exploit it by submitting a crafted backtick-quoted identifier to the POST /api/v1/query endpoint. No user interaction is required.

Q: What data is at risk?

The injection can place a raw subquery outside the per-tenant WHERE guard, allowing exfiltration of analytics data belonging to other organizations. The provided impact information indicates high confidentiality impact, with no stated integrity or availability impact.

Q: Which deployments are affected?

Trigger.dev versions before 4.5.6 are affected. The issue is in the TSQL query compiler's handling of window-function names when generating ClickHouse SQL.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Trigger.dev customer can exploit it by submitting a crafted backtick-quoted identifier to the POST /api/v1/query endpoint. No user interaction is required.

What data is at risk?

The injection can place a raw subquery outside the per-tenant WHERE guard, allowing exfiltration of analytics data belonging to other organizations. The provided impact information indicates high confidentiality impact, with no stated integrity or availability impact.

Which deployments are affected?

Trigger.dev versions before 4.5.6 are affected. The issue is in the TSQL query compiler's handling of window-function names when generating ClickHouse SQL.

CVE-2026-114081: Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data is at risk?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data is at risk?

Which deployments are affected?