Is CVE-2026-114071 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-114071?

CVE-2026-114071 has a CVSS v3 severity of LOW (3.1).

Back

CVE-2026-114071

Description

Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.