CVE-2026-114092: Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
Affected Software
Event History
Frequently Asked Questions
What must an attacker know to exploit this issue?
The attacker needs to know a victim task run's friendlyId. No authentication or organization membership check is performed by the affected replay action handler.
What can an attacker do with a known run friendlyId?
They can replay the victim's run into an environment they choose. This can expose the victim's task payload or cause the task to run again using the victim's secrets.
Which deployments are affected?
Trigger.dev versions before 4.5.0 are affected. The vulnerable behavior is in the dashboard task-run replay route.