CVE-2026-114072Medium· 4.3▾ SunlitThe Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attacker…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
trigger.dev < 4.5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114089High· 8.8Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
CVE-2026-114093Medium· 4.3Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint
CVE-2026-114065Medium· 6.5Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
CVE-2026-114066High· 8.1Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
CVE-2026-114068High· 8.3Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
CVE-2026-114067Medium· 6.5Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route