CVE-2026-85651: Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trigger.devto a version that resolves this vulnerability.Fixed in 4.5.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with the ability to replay their own task runs can exploit it. The attacker does not need user interaction, but must be able to target another organization’s or project’s environment.
Are default deployments affected?
Any Trigger.dev deployment running a version before 4.5.2 is affected if authenticated users can perform run replay operations. The issue is in missing environment-membership validation during those operations.
What can an attacker do through this flaw?
They can inject replayed task runs into arbitrary environments, including environments belonging to other organizations or projects. This can consume victim resources and pollute the affected environment’s run history.
How can I determine whether my deployment is affected?
Check the deployed Trigger.dev version. Versions before 4.5.2 are affected; deployments on 4.5.2 or later are not identified as affected by the provided information.
What should be done if upgrading cannot happen immediately?
The provided information does not specify a workaround. Restricting access to authenticated users who can replay runs may reduce exposure until the deployment can be updated to 4.5.2 or later.