CVE-2026-114079
CVE-2026-114079 · Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.6: Affected (semver)
- 4.5.6: Not affected (semver)
Update to 4.5.6
trigger.dev npm
- Affected ranges
- SEMVER: < 4.5.6
Update to 4.5.6