CVE-2026-73656

Received Received - Intake

Privilege Escalation in Trigger.dev via Deployment ID Manipulation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73656

EUVD

EUVD-2026-58390

Affected Vendors & Products

Vendor	Product	Version / Range
trigger.dev	trigger.dev	to 4.5.6 (inc)
trigger.dev	trigger.dev	to 4.5.0-rc.2 (exc)
trigger.dev	trigger.dev	4.4.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is a critical authorization bypass in Trigger.dev versions 4.5.0-rc.2 and earlier. An attacker with a valid API key for their project can exploit a deployment background-worker registration endpoint to link their malicious worker to another project's deployment by submitting its deployment ID. This changes the victim's deployment state from BUILDING to DEPLOYING without proper authorization checks.

Detection Guidance

Check Trigger.dev versions with npm list trigger.dev or by inspecting the deployment logs for unauthorized background worker attachments or state changes from BUILDING to DEPLOYING.

Impact Analysis

If exploited, this vulnerability allows attackers to disrupt deployments by forcing state changes and attaching malicious worker metadata. This could lead to unauthorized code execution, service disruptions, or data integrity issues in affected deployments.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.6 or later immediately. Review deployment logs for suspicious activity and revoke any unauthorized API keys.

Hi! I’m here to help you understand CVE-2026-73656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70