{"id":"CVE-2026-114085","revision":"6e67666ee40946349b429c449b3d6fa3","records":[{"revision":"6e67666ee40946349b429c449b3d6fa3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-114085","aliases":[],"title":"Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API","description":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start endpoint to obtain resolved environment variables and run JWTs, or start, complete, and suspend other tenants' runs.","state":0,"publishedAt":"2026-10-21T00:36:52.041+00:00","modifiedAt":"2026-10-21T15:49:59.313+00:00","affected":[{"ecosystem":"Vendor product","name":"trigger.dev","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"triggerdotdev\",\n                    \"product\": \"trigger.dev\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/trigger.dev\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"4.7.6\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","score":8.8,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","score":7.9,"severity":"HIGH"}],"references":["https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-jc26-22qp-cgqj","https://www.vulncheck.com/advisories/trigger-dev-through-4.7.6-missing-authentication-in-supervisor-workload-api"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114085","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114085","identifiers":["CVE-2026-114085"]},"retained":false,"historicalAffected":[]}],"coverage":[]}