What is CVE-2026-85651?

CVE-2026-85651 is a high-severity vulnerability, classified under Missing Authorization. CVSS score: 8.5/10. Published 2026-09-04.

How severe is CVE-2026-85651?

High severity. CVSS v3 base score is 8.5 out of 10.

CVE-2026-85651

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim resources and pollute run history.

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L.

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com
disclosure@vulncheck.com

Frequently asked questions

What is CVE-2026-85651?: CVE-2026-85651 is a high-severity vulnerability, classified under Missing Authorization. CVSS score: 8.5/10. Published 2026-09-04.
How severe is CVE-2026-85651?: High severity. CVSS v3 base score is 8.5 out of 10.