CVE-2026-85651
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
HIGH 8.4
En bref
- Source
- NVD
- EPSS
- EPSS 0.49 % · centile 42 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulnCheck
- Statut NVD
- Deferred
Description
Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
- https://github.com/triggerdotdev/trigger.dev/issues/4173
- https://github.com/triggerdotdev/trigger.dev
- https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254
- https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qxpp-qjg8-x4jv
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.2-unauthorized-environment-access-via-run-replay
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L | VulnCheck |
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L | VulnCheck |
| CVSS 4.0 | HIGH 8.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | HIGH 8.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L | NVD · disclosure@vulncheck.com (Secondary) |
Avis
- GHSA-qxpp-qjg8-x4jv — Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Références européennes
- ENISA EUVD · EUVD-2026-71115
- GCVE · GCVE-0-2026-85651
Produits affectés
| Produit | Versions |
|---|---|
| triggerdotdev · trigger.dev | affected 0 < 4.5.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |