Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses `prisma.taskRun.findUnique({ where: { friendlyId: runParam } })` without a runtimeEnvironmentId filter, then ReplayTaskRunService in apps/webapp/app/v3/services/replayTaskRun.server.ts replays the selected run in the victim environment. Any valid environment API key can therefore replay another tenant's run by friendlyId, consuming victim resources and repeating side effects; when `payloadType: "application/store"` is used, overrideExistingPayloadPacket() calls conditionallyImportPacket() on existingTaskRun.payload without an integrity check, so payload bytes overwritten through a separate object-store path-traversal vulnerability become attacker-controlled input to the victim task. This issue is fixed in version 4.5.0-rc.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-13T22:17:27.040Z",
  "pubdate": "2026-08-13T22:17:27.040Z",
  "executiveSummary": "An authorization bypass and lack of integrity checking vulnerability exists in Trigger.dev versions 4.4.2 through 4.5.0-rc.4.\nThe vulnerability allows an authenticated attacker possessing any valid environment API key to replay arbitrary task runs belonging to other tenants by supplying a targeted friendlyId.\nThe affected endpoint POST /api/v1/runs/:runParam/replay uses prisma.taskRun.findUnique with the friendlyId parameter without enforcing a runtimeEnvironmentId filter, causing the ReplayTaskRunService to execute the run within the victim environment.\nFurthermore, when payloadType: application/store is utilized, overrideExistingPayloadPacket calls conditionallyImportPacket on the existing task run payload without performing an integrity check.\nThis permits payload bytes previously manipulated through an object-store path-traversal vulnerability to serve as attacker-controlled input processed directly by the victim task.\nThe impact includes unauthorized consumption of victim compute resources, repetition of unintended side effects, and execution of arbitrary attacker-supplied payloads within isolated victim environments.\nExploitation requires a valid environment API key and knowledge or enumeration of a victim run's friendlyId.\nThe issue is officially resolved in version 4.5.0-rc.4.",
  "technicalDetails": "The root cause of the authorization bypass lies in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts, where the HTTP POST method processes the replay request for a given runParam identifier.\nThe implementation queries the database using prisma.taskRun.findUnique({ where: { friendlyId: runParam } }) but omits a critical runtimeEnvironmentId scope filter.\nConsequently, any authenticated principal holding a valid environment API key can query and target task runs belonging to foreign tenants simply by supplying their distinct friendlyId.\nOnce the target task run is retrieved without proper tenant isolation checks, control is passed to ReplayTaskRunService located in apps/webapp/app/v3/services/replayTaskRun.server.ts.\nThis service initiates the re-execution of the selected task run inside the victim's operational environment, leading to unauthorized resource consumption and the unintended repetition of state-changing side effects.\nIn addition to the cross-tenant replay flaw, a secondary integrity vulnerability is triggered when payloadType: application/store is specified.\nIn this execution path, overrideExistingPayloadPacket invokes conditionallyImportPacket directly on existingTaskRun.payload without validating cryptographic or structural integrity.\nIf an attacker leverages a separate object-store path-traversal vulnerability to overwrite payload bytes in storage, those compromised bytes are ingested as trusted input by the victim task during the replay sequence.\nThe complete attack flow involves authenticating with a valid environment API key, sending a crafted HTTP POST request to /api/v1/runs/:runParam/replay with a foreign tenant's friendlyId, and leveraging pre-manipulated object-store payloads to inject malicious data into the victim's task execution context.\nThe vulnerable components span the API routing logic, database query filters, and payload handling services across versions 4.4.2 up to 4.5.0-rc.4."
}