## Summary
Trigger.dev contains an authorization scoping flaw in the deployment background-worker registration flow. Before 4.5.6, a caller with a valid API key for one project can register/link an attacker-controlled background worker to another project’s deployment (by friendlyId), moving the victim deployment from BUILDING to DEPLOYING.
## Technical Details
- The API route apps/webapp/app/routes/api.v1.deployments.$deploymentId.background-workers.ts authenticates the request, then calls CreateDeploymentBackgroundWorkerServiceV4.call(authenticatedEnv, deploymentId, body).
- In apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, the service fetches the target deployment using workerDeployment.findFirst() with where: { friendlyId: deploymentId }.
- The lookup is not scoped with an environmentId (or equivalent project/environment predicate), so a deployment identifier from another project can be selected.
- The service then creates/finds a background worker under the authenticated caller’s environment and links it to the unscoped deployment record, updating deployment state from BUILDING to DEPLOYING.
- The advisory notes that if the victim later finalizes the polluted deployment, the finalize path follows the linked worker without validating that the worker belongs to the same project/environment.
## Affected
- trigger.dev versions prior to 4.5.6.
- Endpoint: POST /api/v1/deployments/:deploymentId/background-workers.
## Impact
- Cross-project deployment lifecycle manipulation: an attacker can attach attacker-controlled worker metadata to a victim deployment and advance its state.
- Potential promotion of polluted worker links into later lifecycle stages if the victim finalizes the deployment.
- Attack prerequisites: attacker has any valid API key for their own Trigger.dev project and knows/obtains a victim deployment friendlyId.
## Mitigation
1. Upgrade to 4.5.6 or later (fix is included in 4.5.6).
2. Ensure deployment background-worker registration enforces project/environment scoping for both the deployment lookup and the subsequent state transition/linking.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE-639