CVE-2026-114077

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6

Description An authorization bypass exists in the createDeploymentBackgroundWorkerV4() function. The system resolves a WorkerDeployment using only the friendlyId without verifying the environment, project, or organization scope. An attacker with a valid environment API key can send a POST request to the deployment background-workers endpoint using a victim's deployment ID to redirect an in-progress deployment to a worker within the attacker's own environment.

Recommendations Update to version 4.5.6 or later.