CVE-2026-114081
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Oct 21, 2026
Vendor
unknown
Description
Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.