Live › vulnerability › CVE-2026-114079
Go to dashboardTrigger.dev before 4.5.6 scopes deployment lookups by project only, not by environment. A holder of a dev, preview, or CI secret key can call the deployment cancel endpoint and stop in-progress production deployments in the same project.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host or run Trigger.dev before 4.5.6 and issue lower-trust environment API keys (dev, preview, CI) within a project that also deploys to production. An attacker needs one of those keys, and the risk is limited to cancelling deployments in progress rather than reading or running code. Teams on managed Trigger.dev that has already been patched, or who do not issue non-production keys, can skip it.
No product ranges from the sources yet.
trigger.dev --version or the @trigger.dev/core version in package.json) and confirm whether it is below 4.5.6.4.5.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.
This page as .md · .json · in your agent: get_signal("CVE-2026-114079")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.