Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M

CVE-2026-73656Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

Critical 9.9

In plain English

A critical-severity authorization bypass via user-controlled key in trigger.dev from triggerdotdev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.

Affected products (as reported)

Vendor	Product	Versions
triggerdotdev	trigger.dev	< 4.5.2

Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

References

https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-j6vv-pq9h-f4wj x_refsource_CONFIRM
https://github.com/triggerdotdev/trigger.dev/pull/4199 x_refsource_MISC
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254 x_refsource_MISC
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2 x_refsource_MISC