CVE-2026-114077

Deferred Deferred - Pending Action

Authorization Bypass in Trigger.dev via Deployment ID Manipulation

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114077

EUVD

EUVD-2026-107028

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-114077 is an authorization bypass vulnerability in Trigger.dev versions before 4.5.6. It allows attackers with only their own environment API key to manipulate an in-progress deployment by submitting a victim's deployment ID. The vulnerability occurs because the createDeploymentBackgroundWorkerV4 endpoint resolves a WorkerDeployment using only the friendlyId without proper scoping for environment, project, or organization.

Detection Guidance

To detect this vulnerability, check if your trigger.dev instance is running a version before 4.5.6. Use commands like 'npm list trigger.dev' or 'yarn list trigger.dev' to verify the installed version. Inspect API logs for suspicious POST requests to the /createDeploymentBackgroundWorkerV4 endpoint with unexpected deployment ID parameters.

Impact Analysis

Attackers can hijack another tenant's in-progress deployment by redirecting it to point to a worker they control in their own environment. This can lead to unauthorized code execution, data leakage, or disruption of services for the victim's deployment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized processing of personal data, and failure to maintain data integrity and availability.

Mitigation Strategies

Immediately upgrade trigger.dev to version 4.5.6 or later. Review API access logs for any unauthorized deployment modifications. Rotate all environment API keys as a precautionary measure to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-114077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...