CVE-2026-114077: Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Q: What access does an attacker need?

The attacker needs only an API key for an environment they control. They also need the friendly ID of a victim deployment that is in progress.

Q: Which deployments are at risk?

In-progress deployments are affected because the endpoint can associate the deployment with a worker in the attacker’s environment. The vulnerable lookup does not scope the deployment by environment, project, or organization.

Q: What version addresses the issue?

Upgrade to Trigger.dev 4.5.6 or later. Versions before 4.5.6 are affected.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade trigger.dev to a version that resolves this vulnerability.
Fixed in 4.5.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need?

The attacker needs only an API key for an environment they control. They also need the friendly ID of a victim deployment that is in progress.

Which deployments are at risk?

In-progress deployments are affected because the endpoint can associate the deployment with a worker in the attacker’s environment. The vulnerable lookup does not scope the deployment by environment, project, or organization.

What version addresses the issue?

Upgrade to Trigger.dev 4.5.6 or later. Versions before 4.5.6 are affected.

CVE-2026-114077: Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need?

Which deployments are at risk?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need?

Which deployments are at risk?

What version addresses the issue?