Cross-Environment Deployment Cancel Vulnerability in Trigger.dev
Summary
GHSA-4672-hwv6-gq62: Trigger.dev: Cross-environment deployment cancel. Affects trigger.dev versions < 4.5.6. Fixed in 4.5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trigger.dev is a platform that facilitates the management of application deployments across multiple environments, such as development, staging, and production. Each environment is secured with its own secret API key, creating a trust boundary that ensures lower-trust keys cannot access higher-trust environments. However, a flaw in the deployment cancel functionality allows for unauthorized cancellation of deployments across these environments.
Vulnerability Detail
The vulnerability arises from the deployment cancel path in Trigger.dev, which does not enforce environment scoping when canceling deployments. Specifically, the method used to retrieve deployment information only checks the project ID, ignoring the environment ID. This means that a secret API key from a lower-trust environment (like development) can cancel deployments in a higher-trust environment (like production). This asymmetry poses a significant risk, as it allows unauthorized users to disrupt critical production deployments while being unable to read their status due to proper environment scoping in other API routes.
How To Fix
Latest published version: 4.7.7 as of 22 Oct 2026
npm install trigger.dev@4.7.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.5.6
This is the first release that contains the fix.
npm install trigger.dev@4.5.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that API keys are strictly managed and that lower-trust environment keys are not used in contexts where they could inadvertently cancel production deployments. Additionally, consider implementing additional checks in your deployment process to prevent unauthorized cancellations.
Conclusion
The cross-environment deployment cancel vulnerability in Trigger.dev poses a significant risk by allowing unauthorized cancellation of production deployments using lower-trust environment keys. It is crucial to update to the patched version 4.5.6 to mitigate this risk and ensure the security of your deployment processes.
See every vulnerability recorded for trigger.dev →
FAQ
The vulnerability allows a lower-trust environment key to cancel deployments in a higher-trust environment, such as production.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Yes, a patch is available in version 4.5.6 of the Trigger.dev package. Updating to this version will resolve the issue.
If immediate updates are not possible, implement strict API key management and consider additional checks to prevent unauthorized cancellations.
References
Related vulnerabilities
Recent vulnerabilities recorded for trigger.dev.
