Denial of Service Vulnerability in Trigger.dev API Endpoint

CVE-2026-73654

What is CVE-2026-73654?

The vulnerability affects Trigger.dev, a platform for managing AI agents and workflows, allowing attackers to exploit the PUT /api/v1/runs/:runId/metadata endpoint. By using attacker-controlled values for operation.key, an attacker can manipulate the execution context, leading to potential Object.prototype pollution. This exploit can disrupt Prisma queries and Prometheus labels, severely affecting other tenants’ worker authentication and resulting in a denial of service across the platform. This vulnerability is mitigated in version 4.5.6.

References