Moyenne
6.5
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler...
CVE-2026-114092
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com