A flaw in Trigger.dev allows a user who owns a valid API key for one project to register a background worker for a deployment belonging to another project. The underlying code does not verify the deployment’s environment, so the attacker can link a malicious background worker and move the victim deployment from BUILDING to DEPLOYING. The vulnerability is a form of privilege escalation that bypasses normal authorization checks (CWE‑639 and CWE‑862). The affected state change could let an attacker interfere with deployment workflows, potentially leading to unauthorized code execution or service disruption.

The issue affects the Trigger.dev platform (triggerdotdev:trigger.dev) in all releases prior to version 4.5.6. The patch introduced in 4.5.6 adds the missing environment check to prevent cross‑project worker registration.

The CVSS score of 9.9 categorizes this vulnerability as critical, indicating a high likelihood of exploitation if an attacker can obtain an API key for any project. Although EPSS data is unavailable, the lack of preventive checks and remote‑only API access give attackers a clear path to manipulate other projects’ deployments. The vulnerability is not listed in CISA’s KEV catalog and no official workaround is provided, meaning the only mitigations are code changes or up‑grading.