CVE-2026-73656: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1

Trigger.dev, a platform for building AI agents and workflows, had a security flaw in versions before 4.5.6 where an API endpoint didn't properly check which project owned a deployment. This allowed someone with a valid API key for one project to hijack another project's deployment by attaching their own background worker (a component that runs tasks in the background) to it and changing its status.