CVE-2026-73657: Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4,

Trigger.dev, a platform for building AI agents and workflows, had a security flaw in versions 4.4.2 through 4.5.0-rc.4 where an API endpoint didn't properly check which environment a user belonged to before replaying task runs (a process that re-executes a previous job). This allowed someone with a valid API key to replay another organization's tasks, waste their resources, and potentially execute malicious code by overwriting task data through a separate vulnerability.