# Trigger.dev cross-environment deployment cancellation

Source: https://junglewise.ai/threats/trigger-dev-cross-environment-deployment-cancel-2032bf7e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-02  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.4 · Published 2026-10-02

Trigger.dev isolates projects into multiple environments (dev, staging, production, preview) with separate API keys as security boundaries. An attacker with a low-privilege environment key can cancel production deployments despite being unable to read them, bypassing the intended access controls. This allows an attacker to disrupt production deployments by canceling them mid-process.

Technologies: [trigger.dev (npm)](https://junglewise.ai/threats/technologies/npm-trigger-dev), [Trigger.dev](https://junglewise.ai/threats/technologies/trigger-dev). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Trigger.dev](https://junglewise.ai/threats/vendors/trigger-dev).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.4, published 2 October 2026.

**Which products and versions are affected?** trigger.dev (npm) <= 4.5.5; Trigger.dev before commit 5d99457.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run trigger.dev (npm) or Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The deployment cancel endpoint fails to scope database lookups by environment, checking only projectId instead of both projectId and environmentId. While the read endpoint correctly enforces environment isolation, the cancel mutation accepts an authenticated environment but discards the environment identity, allowing any API key within a project to cancel deployments in any other environment. An in-progress deployment (PENDING, INSTALLING, BUILDING, or DEPLOYING status) can be canceled cross-environment with network access and a valid (lower-privilege) API key for the same project.

## Affected products

- Trigger.dev Trigger.dev before commit 5d99457

## Timeline

- 2026-10-02: disclosed

## Related threats

- [Trigger.dev cross-site request forgery in logout endpoint](https://junglewise.ai/threats/cve-2026-114093-trigger-dev-before-4-5-6-contains-a-cross-site-request-forgery)
- [Trigger.dev missing authentication in task run replay](https://junglewise.ai/threats/cve-2026-114092-trigger-dev-before-4-5-0-performs-no-authentication-or)
- [Trigger.dev cross-tenant authorization bypass in run replay](https://junglewise.ai/threats/cve-2026-114091-trigger-dev-before-4-5-0-looks-up-runs-by-friendlyid-alone-in)
- [Trigger.dev cross-site request forgery in CLI authorization flow](https://junglewise.ai/threats/cve-2026-114089-trigger-dev-before-4-5-2-contains-a-cross-site-request-forgery)
- [Trigger.dev hardcoded default secret authentication bypass in Socket.IO](https://junglewise.ai/threats/cve-2026-114088-trigger-dev-before-4-5-4-contains-a-hardcoded-default-secret)