CVE-2026-114077GHSA-2gvw-9968-v578
Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
triggerdotdev trigger.devFrameworks
CVSS
6.1MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.5.6trigger.devCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
Text from CVE List
Affected versions 2
- trigger.devaffected: all versions before 4.5.6CVE List
- trigger.devunaffected: 4.5.6CVE List