Is CVE-2026-114072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114072 being exploited in the wild.

How severe is CVE-2026-114072?

Medium severity, with a CVSS score of 4.3, published 21 October 2026.

Which products and versions are affected?

Trigger.dev Webapp before 4.5.12.

Is there a fix for CVE-2026-114072?

Yes: fixed in 4.5.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114072 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114072?

Check whether you run Trigger.dev Webapp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114072: Trigger.dev cross-site request forgery in Slack OAuth flow

CVE-2026-114072 · Severity: medium · CVSS 4.3 · Published 2026-10-21

Trigger.dev is a workflow automation and alerting platform that integrates with Slack to deliver operational notifications. The webapp contains a flaw in how it validates Slack OAuth connections at the organization level: an attacker can trick an authenticated employee into linking an attacker-controlled Slack workspace to their organization, potentially receiving sensitive operational alerts or being able to interfere with integrations.

Vendors: Trigger.dev.

Quick answers

Is CVE-2026-114072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114072 being exploited in the wild.
How severe is CVE-2026-114072?: Medium severity, with a CVSS score of 4.3, published 21 October 2026.
Which products and versions are affected?: Trigger.dev Webapp before 4.5.12.
Is there a fix for CVE-2026-114072?: Yes: fixed in 4.5.12. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114072 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114072?: Check whether you run Trigger.dev Webapp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.5.12

Technical details

The vulnerability is a cross-site request forgery (CWE-352) in the organization-level Slack OAuth callback handler. The OAuth state parameter is set to the organization ID without binding it to the authenticated session, allowing an attacker with knowledge of the target org ID to craft a callback URL that, when opened by an authenticated member, results in token exchange and integration creation. An attacker must obtain a valid Slack authorization code and social-engineer a victim organization member to click the malicious callback link.

Affected products

Trigger.dev webapp before 4.5.12

Timeline

2026-08-20: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.