CVE-2026-114085: Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Q: What must an attacker have to exploit this issue?

The attacker needs network access to the supervisor workload server and a valid run/snapshot pair. The vulnerability does not require user interaction.

Q: Which deployments are affected?

Trigger.dev versions through 4.7.6 are identified as affected. The provided information does not specify a fixed version or mitigation for deployments that cannot patch immediately.

Published Oct 21, 2026

Updated

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

Affected Software

1 affected component

Trigger.dev Trigger.dev<=4.7.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker have to exploit this issue?

The attacker needs network access to the supervisor workload server and a valid run/snapshot pair. The vulnerability does not require user interaction.

Which deployments are affected?

Trigger.dev versions through 4.7.6 are identified as affected. The provided information does not specify a fixed version or mitigation for deployments that cannot patch immediately.

CVE-2026-114085: Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

Affected Software

Event History

Frequently Asked Questions

What must an attacker have to exploit this issue?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker have to exploit this issue?

Which deployments are affected?