CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
- State
- Published
- Severity
- 8.4 High
- Published
- Sep 4, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 4, 2026
Description
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L | VulnCheck |
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
trigger.devtriggerdotdev |
|
References
- GitHub Issue #4173issue-tracking
- https://github.com/triggerdotdev/trigger.devproduct
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254patch
- Trigger.dev v4.5.2 Release Notesrelease-notes
- GitHub Security Advisory (GHSA-qxpp-qjg8-x4jv)vendor-advisory
- VulnCheck Advisory: Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replaythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.