# Trigger.dev vulnerabilities Source: https://junglewise.ai/threats/technologies/trigger-dev Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/trigger-dev.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Trigger.dev: 0 in the last 7 days and 34 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114093, was published on 21 October 2026. 24 vulnerabilities in the last four weeks, up 200% on the four before (8). 0 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 24 - Last 90 days: 34 - All time: 38 (1 critical, 0 exploited in the wild) ## About Trigger.dev Platform for scheduling and managing JavaScript background jobs and workflows. ## Latest Trigger.dev vulnerabilities - [CVE-2026-114093: Trigger.dev cross-site request forgery in logout endpoint](https://junglewise.ai/threats/cve-2026-114093-trigger-dev-before-4-5-6-contains-a-cross-site-request-forgery) (medium, CVSS 4.3, published 21 Oct 2026) - [CVE-2026-114092: Trigger.dev missing authentication in task run replay](https://junglewise.ai/threats/cve-2026-114092-trigger-dev-before-4-5-0-performs-no-authentication-or) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114091: Trigger.dev cross-tenant authorization bypass in run replay](https://junglewise.ai/threats/cve-2026-114091-trigger-dev-before-4-5-0-looks-up-runs-by-friendlyid-alone-in) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114089: Trigger.dev cross-site request forgery in CLI authorization flow](https://junglewise.ai/threats/cve-2026-114089-trigger-dev-before-4-5-2-contains-a-cross-site-request-forgery) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-114088: Trigger.dev hardcoded default secret authentication bypass in Socket.IO](https://junglewise.ai/threats/cve-2026-114088-trigger-dev-before-4-5-4-contains-a-hardcoded-default-secret) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114087: Trigger.dev authentication bypass via hardcoded secrets in Docker Compose](https://junglewise.ai/threats/cve-2026-114087-trigger-dev-before-4-5-6-self-hosted-docker-compose-deployments) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114086: Trigger.dev missing authentication in realtime streams POST handler](https://junglewise.ai/threats/cve-2026-114086-trigger-dev-before-4-5-5-contains-a-missing-authentication) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-114085: Trigger.dev missing authentication in supervisor workload server](https://junglewise.ai/threats/cve-2026-114085-trigger-dev-through-4-7-6-contains-a-missing-authentication) (high, CVSS 7.9, published 21 Oct 2026) - [CVE-2026-114084: Trigger.dev SQL injection in /realtime/v1/runs endpoint](https://junglewise.ai/threats/cve-2026-114084-trigger-dev-before-4-5-6-contains-an-sql-injection-vulnerability) (high, CVSS 7.7, published 21 Oct 2026) - [CVE-2026-114083: Trigger.dev path traversal in packet endpoints](https://junglewise.ai/threats/cve-2026-114083-trigger-dev-before-4-5-0-rc-3-contains-a-path-traversal) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114082: Trigger.dev authorization bypass in session stream credentials](https://junglewise.ai/threats/cve-2026-114082-trigger-dev-before-4-6-2-contains-an-authorization-vulnerability) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114081: Trigger.dev SQL injection in TSQL query compiler window functions](https://junglewise.ai/threats/cve-2026-114081-trigger-dev-before-4-5-6-contains-an-sql-injection-vulnerability) (high, CVSS 7.7, published 21 Oct 2026) - [CVE-2026-114080: Trigger.dev server-side request forgery in alert-channel webhook URL](https://junglewise.ai/threats/cve-2026-114080-trigger-dev-before-4-5-2-contains-a-blind-server-side-request) (medium, CVSS 5, published 21 Oct 2026) - [CVE-2026-114079: Trigger.dev authorization bypass in deployment cancellation](https://junglewise.ai/threats/cve-2026-114079-trigger-dev-before-4-5-6-contains-an-improper-authorization) (medium, CVSS 5.4, published 21 Oct 2026) - [CVE-2026-114078: Trigger.dev authorization bypass in schedule management services](https://junglewise.ai/threats/cve-2026-114078-trigger-dev-before-4-5-6-contains-an-authorization-bypass) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114077: Trigger.dev authorization bypass in createDeploymentBackgroundWorkerV4](https://junglewise.ai/threats/cve-2026-114077-trigger-dev-before-4-5-6-contains-an-authorization-bypass) (high, CVSS 7.1, published 21 Oct 2026) - [CVE-2026-114076: Trigger.dev server-side request forgery in alert webhook](https://junglewise.ai/threats/cve-2026-114076-trigger-dev-before-4-5-2-contains-a-blind-server-side-request) (medium, CVSS 5.4, published 21 Oct 2026) - [CVE-2026-114075: Trigger.dev authorization bypass in alert channels API](https://junglewise.ai/threats/cve-2026-114075-trigger-dev-before-4-5-12-contains-an-authorization-bypass) (medium, CVSS 5.4, published 21 Oct 2026) - [CVE-2026-114074: Trigger.dev webhook SSRF protection bypass via 198.18.0.0/15 range](https://junglewise.ai/threats/cve-2026-114074-trigger-dev-before-4-5-10-contains-a-server-side-request-forgery) (medium, CVSS 5.4, published 21 Oct 2026) - [CVE-2026-114069: Trigger.dev improper authorization in API environment variables endpoint](https://junglewise.ai/threats/cve-2026-114069-trigger-dev-before-4-6-0-contains-an-improper-authorization) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114068: Trigger.dev missing authorization in waitpoint token endpoint](https://junglewise.ai/threats/cve-2026-114068-trigger-dev-before-4-6-0-contains-a-missing-authorization) (high, CVSS 8.3, published 21 Oct 2026) - [CVE-2026-114067: Trigger.dev improper authorization in snapshot-url endpoint](https://junglewise.ai/threats/cve-2026-114067-trigger-dev-4-5-0-before-4-6-2-contains-an-improper) (medium, CVSS 6.5, published 21 Oct 2026) - [CVE-2026-114066: Trigger.dev authorization bypass in batch-creation API](https://junglewise.ai/threats/cve-2026-114066-trigger-dev-before-4-7-0-contains-a-missing-authorization) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114065: Trigger.dev tenant filtering bypass in query endpoint](https://junglewise.ai/threats/cve-2026-114065-trigger-dev-before-4-7-3-contains-a-tenant-filtering-bypass) (medium, CVSS 6.5, published 21 Oct 2026) - [Trigger.dev cross-environment deployment cancellation](https://junglewise.ai/threats/trigger-dev-cross-environment-deployment-cancel-2032bf7e) (medium, CVSS 5.4, published 2 Oct 2026) ## Most severe Trigger.dev vulnerabilities - [Trigger.dev V1 coordinator default-secret unauthenticated access](https://junglewise.ai/threats/trigger-dev-v1-coordinator-default-secret-unauth-socket-io-232d6390) (critical, published 2 Oct 2026) - [CVE-2026-114089: Trigger.dev cross-site request forgery in CLI authorization flow](https://junglewise.ai/threats/cve-2026-114089-trigger-dev-before-4-5-2-contains-a-cross-site-request-forgery) (high, CVSS 8.8, published 21 Oct 2026) - [CVE-2026-73654: Trigger.dev prototype pollution in run metadata operations](https://junglewise.ai/threats/cve-2026-73654-trigger-dev-prototype-pollution-in-run-metadata-operations) (high, CVSS 8.5, published 13 Aug 2026) - [CVE-2026-85651: Trigger.dev access control bypass in run replay](https://junglewise.ai/threats/cve-2026-85651-trigger-dev-access-control-bypass-in-run-replay) (high, CVSS 8.5, published 4 Sep 2026) - [CVE-2026-114068: Trigger.dev missing authorization in waitpoint token endpoint](https://junglewise.ai/threats/cve-2026-114068-trigger-dev-before-4-6-0-contains-a-missing-authorization) (high, CVSS 8.3, published 21 Oct 2026) - [CVE-2026-73658: Trigger.dev path traversal in presigned URLs](https://junglewise.ai/threats/cve-2026-73658-trigger-dev-path-traversal-in-presigned-urls) (high, CVSS 8.2, published 13 Aug 2026) - [CVE-2026-73659: Trigger.dev path traversal in packet presign routes](https://junglewise.ai/threats/cve-2026-73659-trigger-dev-path-traversal-in-packet-presign-routes) (high, CVSS 8.1, published 13 Aug 2026) - [CVE-2026-114087: Trigger.dev authentication bypass via hardcoded secrets in Docker Compose](https://junglewise.ai/threats/cve-2026-114087-trigger-dev-before-4-5-6-self-hosted-docker-compose-deployments) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114083: Trigger.dev path traversal in packet endpoints](https://junglewise.ai/threats/cve-2026-114083-trigger-dev-before-4-5-0-rc-3-contains-a-path-traversal) (high, CVSS 8.1, published 21 Oct 2026) - [CVE-2026-114082: Trigger.dev authorization bypass in session stream credentials](https://junglewise.ai/threats/cve-2026-114082-trigger-dev-before-4-6-2-contains-an-authorization-vulnerability) (high, CVSS 8.1, published 21 Oct 2026) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up 200% on the four before (8). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 7 | 1 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 24 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Trigger.dev vulnerabilities", https://junglewise.ai/threats/technologies/trigger-dev, 12 November 2026.