CVE-2026-114079

Deferred Deferred - Pending Action

Improper Authorization in Trigger.dev Allows Deployment Cancellation

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with a dev, preview, or CI secret key can POST to the deployment cancel endpoint to cancel in-progress production deployments within the same project.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114079

EUVD

EUVD-2026-106882

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Trigger.dev before version 4.5.6 has an improper authorization vulnerability (CVE-2026-114079) where users with lower-trust environment API keys (dev, preview, or CI) can cancel deployments in other environments within the same project. This happens because the system only checks the project ID when verifying permissions, not the specific environment. Attackers can exploit this by sending a POST request to cancel in-progress production deployments.

Detection Guidance

Check Trigger.dev versions before 4.5.6 using package managers like npm or yarn. Inspect API logs for POST requests to deployment cancel endpoints from lower-trust environment keys (dev, preview, CI). Monitor for unexpected deployment cancellations across environments within the same project.

Impact Analysis

If you use Trigger.dev versions before 4.5.6, an attacker with a lower-privilege API key could cancel your production deployments, causing service disruptions or downtime. This could lead to lost revenue, reputational damage, or operational delays if critical updates are interrupted.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to cancel production deployments. For GDPR, this may affect data integrity and availability requirements. For HIPAA, it could compromise the integrity of systems handling protected health information by enabling unauthorized changes to deployment states.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.6 or later immediately. Rotate all environment API keys, especially dev, preview, and CI keys. Review and restrict project-level access permissions to prevent cross-environment actions. Monitor for unauthorized deployment cancellations.

Hi! I’m here to help you understand CVE-2026-114079. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...