AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-73656

CRITICAL · CVSS 9.9 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The vulnerability allows an authenticated user with a valid API key to manipulate deployments across different projects by linking an attacker-controlled background worker to a victim's deployment. This can result in unauthorized transitions of the victim's deployment state from BUILDING to DEPLOYING, potentially leading to service disruption or unauthorized access. Organizations using Trigger.dev versions prior to 4.5.6 should prioritize patching to mitigate this critical risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-73656
Severity
CRITICAL
CVSS
9.9
EPSS
0.34%

Original NVD Description

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.