CVE-2026-114079: Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Q: Who is exposed to this issue?

Projects that use Trigger.dev versions before 4.5.6 and have lower-trust environment API keys, such as development, preview, or CI keys, are exposed. The affected cross-environment access occurs within the same project.

Q: What does an attacker need to exploit it?

An attacker needs a lower-trust environment secret API key for the target project. They can use it to send a request to the deployment cancel endpoint and cancel an in-progress production deployment.

Q: What is the impact of a successful exploit?

A successful exploit can cancel in-progress production deployments. The provided severity vector indicates integrity and availability impact, with no confidentiality impact.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Projects that use Trigger.dev versions before 4.5.6 and have lower-trust environment API keys, such as development, preview, or CI keys, are exposed. The affected cross-environment access occurs within the same project.

What does an attacker need to exploit it?

An attacker needs a lower-trust environment secret API key for the target project. They can use it to send a request to the deployment cancel endpoint and cancel an in-progress production deployment.

What is the impact of a successful exploit?

A successful exploit can cancel in-progress production deployments. The provided severity vector indicates integrity and availability impact, with no confidentiality impact.

CVE-2026-114079: Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of a successful exploit?