HIGH 7.2 NVD
CVE-2026-114066
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own b
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qwrm-2cq8-xfr8
- https://www.vulncheck.com/advisories/trigger-dev-before-4.7.0-missing-authorization-via-ba
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.