CVE-2026-92773: Trigger.dev before 4.6.0 GitHub App Installation Takeover
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
trigger.devto a version that resolves this vulnerability.Fixed in 4.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
Trigger.dev versions before 4.6.0 are affected. The issue concerns organizations that bind GitHub App installations to Trigger.dev.
What does an attacker need to exploit this?
The attacker needs an authenticated Trigger.dev account with low privileges. Exploitation requires replaying state cookies and supplying sequential GitHub App installation identifiers; no user interaction is required.
What access could a successful attacker obtain?
An attacker can bind another user's GitHub App installation to the attacker’s organization, which can provide unauthorized access to the victim’s repositories.
How can the issue be remediated?
Upgrade Trigger.dev to version 4.6.0 or later, which adds verification that the authenticated user controls the GitHub App installation before it is bound to an organization.