Live › vulnerability › CVE-2026-114077
Go to dashboardTrigger.dev before 4.5.6 looks up a WorkerDeployment by its ID alone, without checking environment, project or organization. A user holding only their own environment API key can point another tenant's in-progress deployment at a worker in their own environment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or multi-tenant Trigger.dev deployments running versions before , where more than one tenant or environment holds API keys. Single-tenant installs where only trusted users hold environment keys face much less risk. The sources do not say whether the hosted cloud service has been patched.
4.5.6No product ranges from the sources yet.
4.5.6 or later is not affected.4.5.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
This page as .md · .json · in your agent: get_signal("CVE-2026-114077")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.