CVE-2026-114077
CVE-2026-114077 · Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
CVSS 6.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.6: Affected (semver)
- 4.5.6: Not affected (semver)
Update to 4.5.6