Is CVE-2026-85651 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85651 being exploited in the wild.

How severe is CVE-2026-85651?

High severity, with a CVSS score of 8.5, published 4 September 2026.

Which products and versions are affected?

trigger.dev (npm) SEMVER:introduced=0,fixed=4.5.2; Trigger.dev before 4.5.2.

Is there a fix for CVE-2026-85651?

Yes. trigger.dev (npm): upgrade to 4.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85651 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85651?

Check whether you run trigger.dev (npm) or Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85651: Trigger.dev access control bypass in run replay

CVE-2026-85651 · Severity: high · CVSS 8.5 · Published 2026-09-04

Trigger.dev is a platform for building and deploying durable workflows and AI agents. Versions before 4.5.2 fail to properly validate that authenticated users can only replay task runs within their own environments, allowing attackers to inject runs into other organizations' environments, consuming their resources and corrupting their run history.

Technologies: trigger.dev (npm), Trigger.dev. Vendors: npm, Trigger.dev.

Quick answers

Is CVE-2026-85651 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85651 being exploited in the wild.
How severe is CVE-2026-85651?: High severity, with a CVSS score of 8.5, published 4 September 2026.
Which products and versions are affected?: trigger.dev (npm) SEMVER:introduced=0,fixed=4.5.2; Trigger.dev before 4.5.2.
Is there a fix for CVE-2026-85651?: Yes. trigger.dev (npm): upgrade to 4.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85651 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85651?: Check whether you run trigger.dev (npm) or Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

trigger.dev (npm): upgrade to 4.5.2 or later
```
npm install trigger.dev@4.5.2
```

Technical details

The vulnerability is an access control bypass in the run replay functionality. Trigger.dev fails to validate environment membership during run replay operations, allowing authenticated attackers to replay their own runs into arbitrary environments belonging to other organizations or projects. The attack requires valid authentication but does not require the attacker to have explicit access to the target environment. An authenticated attacker can exploit this to inject task runs, consume victim resources, and pollute run history. The vulnerability is fixed in version 4.5.2 and later.

Affected products

Trigger.dev Trigger.dev before 4.5.2

Identifiers

CVE-2026-85651
GHSA-qxpp-qjg8-x4jv

Timeline

2026-09-04: disclosed
2026-07-09: patched: Security patch released; version 4.5.2 contains the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.