HIGH 7.1 NVD
CVE-2026-114065
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-m79r-84cc-xwg9
- https://www.vulncheck.com/advisories/trigger-dev-before-4.7.3-tenant-filtering-bypass-via-
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.