Trigger.dev's POST /api/v1/deployments/:deploymentId/background-workers endpoint calls CreateDeploymentBackgroundWorkerServiceV4.call(), which uses workerDeployment.findFirst() to select deployments by friendlyId without filtering by environmentId. This allows an attacker with a valid API key scoped to one project to submit a deployment identifier from another project, effectively bypassing authorization controls. The attacker can associate their own background worker with the victim's deployment and alter the deployment state from BUILDING to DEPLOYING. The vulnerability is tracked as CVE-2026-73656 and is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). It has a CVSS 3.1 base score of 9.9 (critical). The issue is fixed in Trigger.dev version 4.5.6.

An attacker with valid API credentials for one project can manipulate deployments of other projects by linking attacker-controlled background workers to victim deployments and changing deployment states. This can lead to unauthorized actions affecting the integrity and availability of deployments. The vulnerability has a critical severity rating with high impact on confidentiality, integrity, and availability.

Upgrade Trigger.dev to version 4.5.6 or later, where this authorization bypass vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in 4.5.6.