Vulnerability record/PUBLISHED/Published Oct 21, 2026 00:36:51 UTC
CVE-2026-114084
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.
Base score8.3/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityHighSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedOct 28, 2026 15:36:39 UTC
PublishedOct 21, 2026 00:36:51 UTC
ReservedOct 20, 2026 21:46:05 UTC
Credits
- kah-ja
- daniel-mertz