CVE-2026-114065Medium· 6.5▾ SunlitTrigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {databa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.
trigger.dev < 4.7.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114081High· 7.7Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
CVE-2026-114084High· 7.7Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
GHSA-9q4r-4842-93vwHigh· 7.7Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
CVE-2026-114068High· 8.3Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
CVE-2026-114067Medium· 6.5Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route