CVE-2026-73656
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73656.json, https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-j6vv-pq9h-f4wj, https://nvd.nist.gov/vuln/detail/CVE-2026-73656, https://github.com/triggerdotdev/trigger.dev/commit/34b1a181c2a1d33a53ebab88f84b05f81fea4254, https://github.com/triggerdotdev/trigger.dev/pull/4199