Trigger.dev cross-environment deployment cancellation

Severity: medium · CVSS 5.4 · Published 2026-10-02

Trigger.dev isolates projects into multiple environments (dev, staging, production, preview) with separate API keys as security boundaries. An attacker with a low-privilege environment key can cancel production deployments despite being unable to read them, bypassing the intended access controls. This allows an attacker to disrupt production deployments by canceling them mid-process.

Technologies: trigger.dev (npm), Trigger.dev. Vendors: npm, Trigger.dev.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 5.4, published 2 October 2026.
Which products and versions are affected?
trigger.dev (npm) <= 4.5.5; Trigger.dev before commit 5d99457.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run trigger.dev (npm) or Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The deployment cancel endpoint fails to scope database lookups by environment, checking only projectId instead of both projectId and environmentId. While the read endpoint correctly enforces environment isolation, the cancel mutation accepts an authenticated environment but discards the environment identity, allowing any API key within a project to cancel deployments in any other environment. An in-progress deployment (PENDING, INSTALLING, BUILDING, or DEPLOYING status) can be canceled cross-environment with network access and a valid (lower-privilege) API key for the same project.

Affected products

  • Trigger.dev Trigger.dev before commit 5d99457

Timeline

  • 2026-10-02: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.