Cross-project deployment worker registration bypass in Trigger.dev (CVE-2026-73656)

The deployment background-worker registration endpoint in Trigger.dev authenticates requests but looks up the target deployment by friendly ID only, without scoping the lookup to the authenticated environment or project. An attacker with any valid API key for their own Trigger.dev project can supply a victim project's deployment identifier, link an attacker-controlled worker to the victim deployment, and advance it from BUILDING to DEPLOYING state. If the victim subsequently finalizes the polluted deployment, the attacker-controlled worker link can be promoted further into the deployment lifecycle without validation. Affected versions: - <= 4.5.0-rc.2 We recommend updating to: >= v4.5.0-rc.3. CVSS 9.9 · our assessment: act_now Reference: https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-j6vv-pq9h-f4wj Details: https://vuln.today/cve/CVE-2026-73656