A critical authorization flaw in Trigger.dev allows authenticated attackers to inject unauthorized task runs into arbitrary environments, potentially leading to resource exhaustion and system pollution.

This vulnerability is a missing authorization issue (CWE-862) where the application fails to validate environment membership during run replay operations. Any authenticated user can leverage this flaw to inject tasks into environments they should not have access to, effectively bypassing environment isolation.

The ability for an authenticated attacker to inject tasks into arbitrary environments poses a significant risk to operational integrity. Successful exploitation leads to unauthorized resource consumption and corruption of run history, which can disrupt business workflows and obscure malicious activity. With a CVSS score of 8.5, this high severity vulnerability warrants immediate attention to prevent potential service degradation and data integrity issues.

Immediate Action: Upgrade your Trigger.dev installation to version 4.5.2 or later, as this release contains the necessary authorization checks to prevent unauthorized task replay.

Proactive Monitoring: Review audit logs for unusual task run activity, specifically looking for tasks originating from unexpected user accounts or targeting unfamiliar environment IDs.

Compensating Controls: Implement strict network segmentation and access control lists to limit the scope of user interactions with the Trigger.dev API if an immediate update cannot be performed.

Public Exploit Available: Unknown

Given the potential for unauthorized environment access and resource abuse, organizations should prioritize upgrading their Trigger.dev instances to version 4.5.2 immediately. Ensure that your deployment process includes verification of the updated version to confirm the vulnerability is successfully remediated.