Multiple Vulnerabilities in Trigger.dev Versions Prior to 4.5.6 and 4.6.2

• •Trigger.dev versions before 4.5.6 are vulnerable to multiple security flaws.
• •Vulnerabilities include SQL Injection and Authentication Bypass.
• •Patching is critical as no active exploitation has been confirmed yet.

Trigger.dev has multiple vulnerabilities affecting versions before 4.5.6 and 4.6.2, including Cross-Tenant SQL Injection, Cross-Organization Schedule Deletion, and Authentication Bypass via Hardcoded Default Secrets. These vulnerabilities are categorized under CWE-89 and CWE-639, posing risks of unauthorized access and data manipulation. The vulnerabilities could allow attackers to exploit SQL injection flaws and bypass authentication, potentially leading to significant data breaches. Current advisories recommend immediate action to mitigate these risks. No has been confirmed at this time, but organizations are urged to prioritize patching. The vulnerabilities were disclosed on October 22, 2026, with specific GitHub Security Advisories linked for further details.