Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-73656: Trigger.dev: Attacker can hijack another project's deployment

CVE-2026-73656 · published 21 days ago

Summary

An attacker with an API key for one Trigger.dev project can hijack another project's deployment by linking their own worker to it. This can cause the hijacked project to move to the wrong deployment state. Update to version 4.5.6 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
triggerdotdev	trigger.dev	< 4.5.2

Original advisory text

Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.

References

https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-j6vv-pq9h-... x_refsource_CONFIRM
https://github.com/triggerdotdev/trigger.dev/pull/4199 x_refsource_MISC
https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b... x_refsource_MISC
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2 x_refsource_MISC
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73656... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-73656 Vendor Advisory

Severity

9.9 Critical

CVSS 3.1: 9.9 (MITRE)

CVSS 3.1: 9.9 (OSV)

Exploitation

EPSS <1%

Type

CWE-639Authorization Bypass Through User-Controlled Key

CWE-862Missing Authorization

Timeline

Published13 Aug 2026

Updated30 Aug 2026

First seen13 Aug 2026

Sources

CVE-2026-73656 · NVD

CVE-2026-73656 · MITRE

CVE-2026-73656 · OSV

GHSA-j6vv-pq9h-f4wj · GHSA

Monitor software like this

Free during beta