CVE-2026-114068: falha de alta gravidade em triggerdotdev trigger.dev
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.4%
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
triggerdotdev · trigger.devCVEs relacionadas — triggerdotdev trigger.dev
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.6%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-73656CRITICALTrigger.dev: Cross-project deployment worker registration can modify another project's deployment stateEPSS 0.5%CVE-2026-114083HIGHTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL EndpointsEPSS 0.5%