CVE-2026-73656

Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

State: Published
Severity: 9.9 Critical
Published: Aug 13, 2026
Updated: Aug 14, 2026
Reserved: Aug 13, 2026

Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.

Scores

CVSS	Score	Vector	Source
3.1	9.9 Critical	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization

Affected Products

Product	Versions
trigger.devtriggerdotdev	< 4.5.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.