Unauthorized Environment Access in Trigger.dev by Trigger.dev

CVE-2026-85651

What is CVE-2026-85651?

Trigger.dev versions prior to 4.5.2 exhibit a flaw in validating environment membership during run replay operations. This vulnerability enables authenticated attackers to inject their own task runs into the environments of other organizations or projects. Consequently, this can lead to resource consumption of the victims and the pollution of the run history, ultimately jeopardizing operational integrity and potentially exposing sensitive data.

References