Trigger.dev versions up to 4.7.6 contain an authentication bypass in the supervisor workload server. The endpoint used to start runs can be called without verifying the caller’s ownership. An attacker who can access the network and possesses a valid run/snapshot pair can use this flaw to read resolved environment variables, steal run JWTs, and start, complete, or suspend runs belonging to other deployments. This allows data disclosure and potential control over other tenants’ workflows.

The vulnerability affects Trigger.dev, specifically all releases up to and including version 4.7.6. Users running any of these early releases are impacted.

The flaw is rated with a CVSS score of 8.8. Its EPSS score is below 1%, indicating a very low documented exploitation probability, and it is not listed in the CISA KEV catalog. Attackers typically need network access to the supervisor workload API and valid run/snapshot credentials; the description indicates that access to the attempts/start endpoint is sufficient to exploit the issue. Without additional authentication checks, the vulnerability is readily exploitable by anyone who can reach the API and meet the minimal credential requirement.