Trigger.dev before version 4.6.0 contains a missing authorization flaw in the waitpoint token wait endpoint. An attacker that possesses any secret API key can supply a victim run ID with their own waitpoint, causing that run to hang indefinitely on a waitpoint the victim cannot complete. The attacker can also inject resume data into the blocked run. This enables attackers to deny service to other organizations’ runs and tamper with run state.

The vulnerability affects all installations of Trigger.dev running versions prior to 4.6.0. Anyone whose environment is maintained on a release older than 4.6.0 is potentially exposed and can be impacted by the malicious waitpoint token requests.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that the probability of exploitation is low, and the vulnerability is not currently listed in CISA’s KEV catalog. Nevertheless, the attack vector requires an authenticated attacker with a valid API key, which can be legitimately available to external users. Once the attacker has such a key, they can easily trigger the endpoint and cause denial of service for other tenants and modify run data. The overall risk is moderate to high, especially for organizations that do not tightly control API key privileges.