Replay Vulnerability in Trigger.dev's Managed AI Agents
CVE-2026-73657

4.2MEDIUM

Key Information:

Vendor: Triggerdotdev
Status: Trigger.dev
Vendor: CVE Published:; 13 August 2026

🔔 Create Triggerdotdev Vulnerability Alert

What is CVE-2026-73657?

The Trigger.dev platform exposes a vulnerability in its API for replaying task runs, where valid API keys can replay tasks across different tenants. Specifically, the endpoint POST /api/v1/runs/:runParam/replay does not filter requests by a runtime environment, allowing attackers to use any valid environment API key to access and replay other tenants’ task runs. This can lead to resource consumption and unintended side effects within the victim's environment. Furthermore, this vulnerability allows for the injection of manipulated payloads due to a lack of integrity checks. A fix is available in version 4.5.0-rc.4.