{"id":"CVE-2026-114079","kind":"vulnerability","aliases":["CVE-2026-114079"],"related":[],"title":"Trigger.dev: low-trust API keys can cancel production deployments","description":"Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.","summary":"Trigger.dev before 4.5.6 scopes deployment lookups by project only, not by environment. A holder of a dev, preview, or CI secret key can call the deployment cancel endpoint and stop in-progress production deployments in the same project.","severity":"medium","cvss":5.4,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","package","self-hosted","trigger.dev"],"not_affected_if":["no-shared-nonprod-keys","patched-version"],"how_to_check":"- Check the installed Trigger.dev version (`trigger.dev --version` or the `@trigger.dev/core` version in `package.json`) and confirm whether it is below `4.5.6`.\n- Review which API keys exist for the project and whether non-production dev, preview, or CI secret keys are shared beyond trusted users.","fix":"- Upgrade Trigger.dev to `4.5.6` or later.\n- Until upgraded, rotate dev, preview, and CI secret keys that are shared with less-trusted parties.","status":"open","published_at":"2026-10-21T01:17:32+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:14:40+00:00","updated_at":"2026-10-25T04:14:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Trigger.dev to `4.5.6` or later.\n- Until upgraded, rotate dev, preview, and CI secret keys that are shared with less-trusted parties.","reach":"internet","title":"Trigger.dev: low-trust API keys can cancel production deployments","impact":"low","summary":"Trigger.dev before 4.5.6 scopes deployment lookups by project only, not by environment. A holder of a dev, preview, or CI secret key can call the deployment cancel endpoint and stop in-progress production deployments in the same project.","category":"package","nicknames":[],"who_cares":["trigger.dev","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker cancels in-progress production deployments within the same project.","analyst_note":"","how_to_check":"- Check the installed Trigger.dev version (`trigger.dev --version` or the `@trigger.dev/core` version in `package.json`) and confirm whether it is below `4.5.6`.\n- Review which API keys exist for the project and whether non-production dev, preview, or CI secret keys are shared beyond trusted users.","needs_analyst":false,"not_affected_if":["patched-version","no-shared-nonprod-keys"],"who_is_affected":"Teams that self-host or run Trigger.dev before 4.5.6 and issue lower-trust environment API keys (dev, preview, CI) within a project that also deploys to production. An attacker needs one of those keys, and the risk is limited to cancelling deployments in progress rather than reading or running code. Teams on managed Trigger.dev that has already been patched, or who do not issue non-production keys, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3390,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114079':13A,16A '-2026':12A,15A '4.5.6':27B,66C 'allow':73C 'api':5A,80C 'attack':94C 'author':70C 'call':48B 'cancel':8A,51B,83C,108C,111C 'cd':19B 'ci':18B,44B,100C 'ci-cd':17B 'contain':67C 'cve':11A,14A 'deploy':10A,29B,50B,59B,86C,107C,116C 'deploymentservice.getdeployment':88C 'dev':41B,97C 'endpoint':52B,109C 'environ':36B,79C,85C 'holder':38B,74C 'host':23B 'improp':69C 'in-progress':55B,112C 'key':6A,46B,81C,102C 'lookup':30B,90C 'low':3A 'low-trust':2A 'lower':77C 'lower-trust':76C 'packag':20B 'post':104C 'preview':42B,98C 'product':9A,58B,115C 'progress':57B,114C 'project':32B,63B,120C 'projectid':92C 'scope':28B,89C 'secret':45B,101C 'self':22B 'self-host':21B 'stop':54B 'trigger.dev':1A,24B,25B,64C 'trust':4A,78C 'vulner':71C 'within':117C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run Trigger.dev before 4.5.6 and issue lower-trust environment API keys (dev, preview, CI) within a project that also deploys to production. An attacker needs one of those keys, and the risk is limited to cancelling deployments in progress rather than reading or running code. Teams on managed Trigger.dev that has already been patched, or who do not issue non-production keys, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114079","severity":null,"published_at":"2026-10-21T01:17:32+00:00","modified_at":"2026-10-21T01:17:32+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114079","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114079","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}