Vulnerabilities

Vulnerability · CVE-2026-114081

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

Published Oct 2, 2026 · catalog updated Oct 21, 2026 · Trigger.dev: Cross-tenant SQL injection

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-114081. A missing EPSS score is not a low risk. Compare Trigger.dev: Cross-tenant SQL injection with the linked advisory before you change production.

Severity

High7.7

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

npm trigger.dev

### Summary A cross-tenant SQL injection in the TSQL query compiler lets **any authenticated trigger.dev customer read every other tenant's analytics data**. The customer-facing query endpoint accepts a TSQL/TRQL query that is compiled to ClickHouse SQL by . The compiler parameterizes or escapes all user input and injects a per-tenant guard — **except the window-function name**, which is concatenated into the SQL string with no allowlist and no escaping. By smuggling a backtick-quoted identifier into that position, an attacker injects a raw subquery (e.g. ) that sits **outside** the tenant guard, exfiltrating another organization's rows. Verified end-to-end against the real compiler and a live ClickHouse. ### Details **Vulnerable sink** — , : is emitted directly into the SQL with **no allowlist check and no identifier escaping**. This is the only place in the compiler where an attacker-influenced identifier reaches the output unguarded: - The normal function-call path ( ) throws for any name outside the hardcoded / allowlists — **this gate is absent on the window-function path**. - String constants are bound as ClickHouse (parameterized). - Other identifiers go through . - Table functions ( ) are rejected. A **backtick-quoted identifier** is accepted by the lexer and **unescaped** into by (the backticks are stripped and the inner text is unescaped), so arbitrary characters — spaces, , , , , a full subquery — become the "function name" and are printed verbatim. **How it bypasses tenant isolation.** Multi-tenancy is enforced only by , which is attached to the **outer** table's ( / / taken from the caller's API key). An injected **subquery** has no such guard, so it reads across all tenants. **Reachability** — : - is a raw . - Auth is any environment-scoped credential — a private API key or a public JWT — i.e. **any signed-up customer**. - The route's authorization ( + ) only authorizes the **outer table** the caller is legitimately allowed to read. The injection rides