Vulnerability Description
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xrp6-5fpv-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-missing-authorizat
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xrp6-5fpv-
FAQ
What is CVE-2026-114068?
CVE-2026-114068 is a vulnerability with a CVSS score of 8.3 (HIGH). Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attacke...
How severe is CVE-2026-114068?
CVE-2026-114068 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114068?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.