Executive brief
Trigger.dev is a platform for deploying AI agents and automated workflows. A vulnerability in versions 4.4.2 through 4.5.0-rc.3 allows attackers with a valid API key from one tenant to replay another tenant's workflow runs without authorization, potentially consuming their resources and repeating unintended actions. When combined with a separate object-store vulnerability, attackers can inject malicious payloads into victim workflows, leading to arbitrary code execution within those runs.
Technical details
The vulnerability stems from an authorization bypass in the `POST /api/v1/runs/:runParam/replay` endpoint. The endpoint uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` to retrieve run records without filtering by the requesting tenant's runtimeEnvironmentId, allowing any API key holder to reference any run by its friendlyId. The ReplayTaskRunService then executes the run in the attacker's environment. Additionally, when payload storage uses `application/store`, the `overrideExistingPayloadPacket()` function calls `conditionallyImportPacket()` on untrusted payload bytes without integrity validation, permitting payload injection when combined with an object-store path-traversal vulnerability. The fix in version 4.5.0-rc.4 adds proper tenant isolation checks and payload integrity validation.
Affected products
- Trigger.dev Trigger.dev 4.4.2 to 4.5.0-rc.3
Timeline
- 2026-08-13: disclosed
- 2026-05-26: patched: Fix merged in PR #3756 which added proper tenant filtering and payload integrity validation