CVE-2026-73656 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, API key management, security, and vulnerability management should assess exposure and apply the fix. This includes reviewing the current version of Trigger.dev, verifying the integrity of deployments, and ensuring that API keys are properly secured and scoped. Additionally, defenders should consider the potential operational impacts, such as potential unauthorized deployment manipulation, elevation of for

Why it matters

CVE-2026-73656 is a critical vulnerability in Trigger.dev that allows an attacker to manipulate deployments, potentially disrupting service or data integrity. Defenders should prioritize verifying exposure and applying the fix.

• Potential unauthorized deployment manipulation
• Elevation of privileges for an attacker with a valid API key
• Possible disruption of service or data integrity

Technical summary

The vulnerability is caused by the lack of an environmentId predicate in the workerDeployment.findFirst() function, which allows an attacker to manipulate another project's deployment. This issue is fixed in version 4.5.6. An attacker with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. Defenders should prioritize verifying exposure and applying the fix, as the vulnerability has a high CVSS score of 9.9 and is considered critical.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability has a high CVSS score of 9.9 and is considered critical.

Recommended defensive actions

• Verify exposure by checking if the current version of Trigger.dev is prior to 4.5.6
• Apply the fix by upgrading to version 4.5.6 or later
• Review API key management and ensure that keys are properly secured and scoped
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability details are based on the official CVE Program record and the NIST National Vulnerability Database entry. The issue is described in the source references provided, including GitHub commits, pull requests, and release notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.