# CVE-2026-114085: Trigger.dev missing authentication in supervisor workload server

Source: https://junglewise.ai/threats/cve-2026-114085-trigger-dev-through-4-7-6-contains-a-missing-authentication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114085 · Severity: high · CVSS 7.9 · Published 2026-10-21

Trigger.dev is a workflow automation platform that orchestrates job runs and deployments. A missing authentication vulnerability in its supervisor workload server allows attackers with network access to manipulate runs, access environment variables, and obtain authentication tokens belonging to other tenants' deployments. This could lead to data exposure, cross-tenant job interference, and credential compromise.

Technologies: [Trigger.dev](https://junglewise.ai/threats/technologies/trigger-dev). Vendors: [Trigger.dev](https://junglewise.ai/threats/vendors/trigger-dev).

## Quick answers

**Is CVE-2026-114085 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114085 being exploited in the wild.

**How severe is CVE-2026-114085?** High severity, with a CVSS score of 7.9, published 21 October 2026.

**Which products and versions are affected?** Trigger.dev through 4.7.6.

**Is there a fix for CVE-2026-114085?** Yes: fixed in 4.6.0 (GitHub advisory states affected versions <= 4.6.0 with patched versions >= 4.6.0, though CVE states through 4.7.6; 4.6.0 is the earliest confirmed patch). Until then: Restrict network access to the supervisor workload server and ensure it is not reachable from untrusted networks. Implement a network firewall or VPC security group to limit access to the supervisor API endpoints. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114085 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-114085?** Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.6.0 (GitHub advisory states affected versions <= 4.6.0 with patched versions >= 4.6.0, though CVE states through 4.7.6; 4.6.0 is the earliest confirmed patch)

Restrict network access to the supervisor workload server and ensure it is not reachable from untrusted networks. Implement a network firewall or VPC security group to limit access to the supervisor API endpoints.

## Technical details

The vulnerability is a missing authentication (CWE-306) in the supervisor workload server's HTTP API endpoints (/api/v1/workload-actions/*) that handle critical run lifecycle operations. Attackers who know a valid run/snapshot pair and have network access to the supervisor can call endpoints like attempts/start without cryptographic verification, exploiting a confused-deputy condition where the supervisor forwards requests with its privileged credentials. This allows extraction of resolved environment variables, run JWTs, and manipulation of other tenants' runs.

## Affected products

- Trigger.dev Trigger.dev through 4.7.6

## Timeline

- 2026-09-14: disclosed: GitHub Security Advisory GHSA-jc26-22qp-cgqj published
- 2026-10-20: advisory
- 2026-10-21: other: CVE-2026-114085 published on NVD

## References

- [https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj](https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj)
- [https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api](https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api)

## Related threats

- [Trigger.dev cross-site request forgery in logout endpoint](https://junglewise.ai/threats/cve-2026-114093-trigger-dev-before-4-5-6-contains-a-cross-site-request-forgery)
- [Trigger.dev missing authentication in task run replay](https://junglewise.ai/threats/cve-2026-114092-trigger-dev-before-4-5-0-performs-no-authentication-or)
- [Trigger.dev cross-tenant authorization bypass in run replay](https://junglewise.ai/threats/cve-2026-114091-trigger-dev-before-4-5-0-looks-up-runs-by-friendlyid-alone-in)
- [Trigger.dev cross-site request forgery in CLI authorization flow](https://junglewise.ai/threats/cve-2026-114089-trigger-dev-before-4-5-2-contains-a-cross-site-request-forgery)
- [Trigger.dev hardcoded default secret authentication bypass in Socket.IO](https://junglewise.ai/threats/cve-2026-114088-trigger-dev-before-4-5-4-contains-a-hardcoded-default-secret)