Is CVE-2026-114084 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114084 being exploited in the wild.

How severe is CVE-2026-114084?

High severity, with a CVSS score of 7.7, published 21 October 2026.

How is CVE-2026-114084 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114084?

Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114084: Trigger.dev SQL injection in /realtime/v1/runs endpoint

CVE-2026-114084 · Severity: high · CVSS 7.7 · Published 2026-10-21

Trigger.dev is a workflow automation platform that self-hosted instances use to orchestrate task execution. An SQL injection vulnerability in the realtime API allows authenticated users with basic read permissions to bypass tenant isolation and access task records from all organizations on the same instance, exposing sensitive payloads, metadata, and execution details. This affects self-hosted deployments running ElectricSQL, the default configuration.

Technologies: Trigger.dev. Vendors: Trigger.dev.

Quick answers

Is CVE-2026-114084 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114084 being exploited in the wild.
How severe is CVE-2026-114084?: High severity, with a CVSS score of 7.7, published 21 October 2026.
Which products and versions are affected?: Trigger.dev before 4.5.6.
Is there a fix for CVE-2026-114084?: Yes: fixed in 4.5.6. Until then: Restrict project API key distribution and audit which keys have read:runs scope; disable ElectricSQL if realtime features are not required. For multi-organization self-hosted instances without the patch, implement network-level isolation between tenants or run separate Trigger.dev instances per organization. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114084 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114084?: Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.5.6

Restrict project API key distribution and audit which keys have read:runs scope; disable ElectricSQL if realtime features are not required. For multi-organization self-hosted instances without the patch, implement network-level isolation between tenants or run separate Trigger.dev instances per organization.

Technical details

The /realtime/v1/runs endpoint unsafely concatenates the caller-supplied tags query parameter into an ElectricSQL where clause without escaping, allowing attackers to close the array literal and inject boolean conditions that defeat the runtimeEnvironmentId tenant guard. An attacker with any project API key holding read:runs scope can inject payloads like x'] OR true -- to reduce the where clause to always true and stream TaskRun records across all organizations. Electric's expression parser restricts the injection to data-disclosure only, blocking functions, subqueries, and write operations.

Affected products

Trigger.dev Trigger.dev before 4.5.6

Timeline

2026-07-21: disclosed
2026-10-20: advisory
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.