Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Trigger.dev versions before 4.5.6 (npm package trigger.dev) let a secret API key for one environment of a project cancel in-progress deployments in other environments of the same project, including production, even though reading those deployments is correctly restricted. An attacker needs a valid key for any environment in that project, such as a development or preview key. Upgrade to version 4.5.6 or later, which is the fixed version listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0030, the 23rd percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:33 UTC First seen by agentprime
- 31 Oct 2026, 13:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-4672-hwv6-gq62
- OSV: GHSA-4672-hwv6-gq62
- github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-4672-hwv6-gq62
- github.com/triggerdotdev/trigger.dev/pull/4316
- github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0
- github.com/triggerdotdev/trigger.dev
- github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.6