CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to verify environment membership (CWE-862, missing authorization) during run replay operations, so an authenticated attacker can replay runs into environments belonging to other organizations or projects. The attack is triggered over the network by a low-privileged authenticated user and requires no user interaction or special conditions. The attacker gains the ability to inject their own task runs into victims' environments, consuming victim compute resources and polluting run history, which drives the high integrity and low availability impact reflected in the 8.4 CVSS 4.0 score. Any Trigger.dev deployment (self-hosted or cloud) running a version prior to 4.5.2 is affected. Exploitation has not been observed: there is no known public proof-of-concept, EPSS is 0.3%, and the issue is not in CISA KEV.

What to do: Upgrade Trigger.dev to 4.5.2 or later, which adds environment membership validation on replay. Until patched, restrict replay capabilities to trusted users and review run history for unexpected runs injected into other organizations' or projects' environments.