CVE Alert: CVE-2026-92773 – triggerdotdev

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user’s GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim’s repositories.

High-risk authorisation bypass requiring urgent remediation, but current data does not indicate active exploitation; SSVC assesses exploitation as none, while KEV and EPSS status are unavailable.

Successful abuse could attach a victim’s GitHub App installation to an attacker-controlled organisation, exposing repository contents and enabling unauthorised changes to connected automation. The changed scope increases the potential for supply-chain impact, including theft of source code, secrets embedded in repositories, or manipulation of deployment workflows.

### Most likely attack path

An attacker first obtains a low-privilege account, then reaches the network-facing GitHub integration without requiring victim interaction. Exploitation has high complexity and requires a favourable precondition, but no further user action; the changed scope means access can extend from the Trigger.dev environment into connected GitHub repositories.

### Who is most exposed

Organisations running self-hosted Trigger.dev with GitHub App integrations, broad repository permissions, or production deployment workflows are most exposed. Risk is greater where many tenants, repositories, or external collaborators the same instance.

Review GitHub App installation, organisation-linking, and repository-access audit events.

Identify unexpected installation-to-organisation associations or rapid reassignment patterns.

Correlate Trigger.dev account logins with unusual installation identifiers and session-state activity.

Audit repository access tokens, workflow changes, and secret reads following suspicious linkage events.

### Mitigation and prioritisation

Apply the vendor fix as an urgent/high-priority change; prioritise internet-facing and production-connected instances.

Treat as priority 1 if KEV is subsequently confirmed or EPSS reaches 0.5 or higher.

Temporarily restrict GitHub App permissions and disable non-essential integrations where practical.

Revalidate all existing installation bindings and rotate potentially exposed tokens or secrets.

Record the change as security-critical, with rollback planning and post-upgrade verification.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.