CVE-2026-73656criticalCWE-639CWE-862

CVE-2026-73656: falha crítica em triggerdotdev trigger.dev

Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar trigger.dev

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.5%
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Produtos afetados
triggerdotdev · trigger.dev
CVEs relacionadas — triggerdotdev trigger.dev

No mesmo produto, das mais perigosas para as menos.

CVE-2026-73654HIGHTrigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoSEPSS 0.6%CVE-2026-114092HIGHTrigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay ActionEPSS 0.6%CVE-2026-114087CRITICALTrigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsEPSS 0.5%CVE-2026-73659HIGHTrigger.dev: Cross-tenant object read/write via path traversal in packet presign APIEPSS 0.5%CVE-2026-114083HIGHTrigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL EndpointsEPSS 0.5%CVE-2026-85651HIGHTrigger.dev before 4.5.2 Unauthorized Environment Access via Run ReplayEPSS 0.5%