Is CVE-2026-114085 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114085 being exploited in the wild.

How severe is CVE-2026-114085?

High severity, with a CVSS score of 7.9, published 21 October 2026.

How is CVE-2026-114085 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-114085?

Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114085: Trigger.dev missing authentication in supervisor workload server

CVE-2026-114085 · Severity: high · CVSS 7.9 · Published 2026-10-21

Trigger.dev is a workflow automation platform that orchestrates job runs and deployments. A missing authentication vulnerability in its supervisor workload server allows attackers with network access to manipulate runs, access environment variables, and obtain authentication tokens belonging to other tenants' deployments. This could lead to data exposure, cross-tenant job interference, and credential compromise.

Technologies: Trigger.dev. Vendors: Trigger.dev.

Quick answers

Is CVE-2026-114085 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114085 being exploited in the wild.
How severe is CVE-2026-114085?: High severity, with a CVSS score of 7.9, published 21 October 2026.
Which products and versions are affected?: Trigger.dev through 4.7.6.
Is there a fix for CVE-2026-114085?: Yes: fixed in 4.6.0 (GitHub advisory states affected versions <= 4.6.0 with patched versions >= 4.6.0, though CVE states through 4.7.6; 4.6.0 is the earliest confirmed patch). Until then: Restrict network access to the supervisor workload server and ensure it is not reachable from untrusted networks. Implement a network firewall or VPC security group to limit access to the supervisor API endpoints. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114085 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-114085?: Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.6.0 (GitHub advisory states affected versions <= 4.6.0 with patched versions >= 4.6.0, though CVE states through 4.7.6; 4.6.0 is the earliest confirmed patch)

Restrict network access to the supervisor workload server and ensure it is not reachable from untrusted networks. Implement a network firewall or VPC security group to limit access to the supervisor API endpoints.

Technical details

The vulnerability is a missing authentication (CWE-306) in the supervisor workload server's HTTP API endpoints (/api/v1/workload-actions/*) that handle critical run lifecycle operations. Attackers who know a valid run/snapshot pair and have network access to the supervisor can call endpoints like attempts/start without cryptographic verification, exploiting a confused-deputy condition where the supervisor forwards requests with its privileged credentials. This allows extraction of resolved environment variables, run JWTs, and manipulation of other tenants' runs.

Affected products

Trigger.dev Trigger.dev through 4.7.6

Timeline

2026-09-14: disclosed: GitHub Security Advisory GHSA-jc26-22qp-cgqj published
2026-10-20: advisory
2026-10-21: other: CVE-2026-114085 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.