CVE-2026-114079
CVE-2026-114079 · Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.
CVSS 5.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
trigger.dev
- Versiones
- ≥ 0, < 4.5.6: Afectada (semver)
- 4.5.6: No afectada (semver)
Actualiza a 4.5.6
trigger.dev npm
- Intervalos de versiones afectados
- SEMVER: < 4.5.6
Actualiza a 4.5.6