CVE-2026-114085CWE-306

CVE-2026-114085

High · published October 21, 2026

CVSS v3.1
7.9
EPSS
0%
Percentile
5.0
In the wild
Unconfirmed
What it is

Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.

The record
Technical detail
CVSS v3.1
7.9 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
8.8 · CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.00162 · 5.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-21T05:17Z
References (2)
https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj · [email protected]https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 21 OCT 00:36Z
    Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
    cvelistv5
  • 21 OCT 00:36Z
    Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API
    cvelistv5