MEDIUM 6.1 NVD
CVE-2026-114077
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alo
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-2gvw-9968-v578
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-tenant-deployment-hija
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.