CVE-2026-114077 Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deploymen...

CVE-2026-114077

Versions of Trigger.dev prior to 4.5.6 are vulnerable to an authorization bypass within the createDeploymentBackgroundWorkerV4 function. The root cause is that the system resolves a WorkerDeployment using only its friendlyId without verifying the environment, project, or organization scope. This ...

CVE-2026-73656

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts,...