CVE-2026-114079: Authorization Bypass Through User-Controlled Key in triggerdotdev trigger.dev

CVE-2026-114079 describes an improper authorization vulnerability in trigger.dev prior to version 4.5.6. The flaw allows holders of lower-trust environment API keys to cancel deployments in other environments of the same project. Specifically, the DeploymentService.getDeployment method scopes deployment lookups solely by projectId, enabling attackers with dev, preview, or CI secret keys to POST to the deployment cancel endpoint and cancel in-progress production deployments. This bypasses intended authorization boundaries between environments.

Attackers with lower-trust environment API keys can disrupt production workflows by canceling in-progress production deployments within the same project. This could lead to denial of service for deployment processes but does not indicate privilege escalation beyond deployment cancellation or data compromise.

Upgrade trigger.dev to version 4.5.6 or later, where this authorization bypass vulnerability has been fixed. No other mitigation guidance is provided, and no indication exists that the vulnerability is already mitigated or requires temporary workarounds.