{"id":"CVE-2026-114066","aliases":["GHSA-qwrm-2cq8-xfr8"],"url":"https://o3.security/vulnerability/CVE-2026-114066","summary":"Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints","details":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.","published":"2026-10-21T00:36:38.884Z","modified":"2026-10-24T02:50:11.379234654Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114066.json"},{"type":"ADVISORY","url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qwrm-2cq8-xfr8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114066"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/trigger-dev-before-4.7.0-missing-authorization-via-batch-parentrunid-waitpoints"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:50:11.379234654Z"}}