Trigger.dev Cross-Tenant Task Run Replay via Missing Environment Scope Check (IDOR)

Technical Analysis

The vulnerable endpoint POST /api/v1/runs/:runParam/replay resolves the target task run via prisma.taskRun.findUnique({ where: { friendlyId } }) with no runtimeEnvironmentId scoping, so the authorization boundary between tenants is broken (BOLA/IDOR). ReplayTaskRunService then executes the replay in the actual owning environment regardless of which tenant's API key initiated the request, meaning the attacker only needs a valid API key (any environment) and a guessable or leaked friendlyId. When the run uses payloadType 'application/store', overrideExistingPayloadPacket() calls conditionallyImportPacket() on the existing payload without integrity verification; chained with a separate object-store path-traversal flaw that lets an attacker overwrite stored payload bytes, this allows attacker-controlled data to be fed into the victim's re-executed agent task, crossing a tenant/data-integrity boundary in an agent orchestration platform. Impact includes resource-exhaustion (unauthorized compute consumption), repeated unintended side effects (e.g., duplicate downstream API calls, notifications, payments), and potential injection of malicious input into victim agent workflows.

Affected Systems

Trigger.dev

Detection Signatures

• Unexpected /api/v1/runs/:runParam/replay calls where the authenticated environment/API key does not match the run's owning environment
• Repeated or unauthorized replay calls against friendlyIds not previously seen by the calling tenant
• Anomalous spike in task run replays correlated with cross-tenant API key usage
• TaskRun payload objects with payloadType 'application/store' showing unexpected modification timestamps or checksum mismatches
• Object-store write/read paths containing traversal sequences (../) or referencing paths outside the tenant's storage prefix

Remediation Steps

1. 1

   Upgrade Trigger.dev

   Update to version 4.5.0-rc.4 or later, which adds proper environment scoping to the replay lookup.

2. 2

   Enforce tenant-scoped queries

   Ensure all Prisma/database lookups keyed on user-supplied identifiers (like friendlyId) include a mandatory runtimeEnvironmentId or tenant filter, not just at the API layer but at the data-access layer.

3. 3

   Add payload integrity checks

   Verify integrity (e.g., signed checksums) of stored task payloads before conditionallyImportPacket() reuses them during replay, to prevent tampered payload injection.

4. 4

   Audit and patch the object-store path traversal

   Remediate the referenced object-store path-traversal vulnerability that allows payload overwrite, since it is a prerequisite for the payload-injection variant of this attack.

5. 5

   Monitor replay API usage

   Add logging/alerting for replay requests where the requesting environment differs from the run's owning environment, and rate-limit replay calls per API key.