All vulnerabilities
CVE-2026-114087GHSA-pqxw-g93w-hj9x

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

triggerdotdev trigger.devnpmFrameworks
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 22 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.6Fixed versionCVE List
Published21 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 4.5.6trigger.devCVE List
  • 4.5.6trigger.dev, npmOSVnpm install trigger.dev@4.5.6

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

Text from CVE List

Affected versions 3

  • trigger.devaffected: all versions before 4.5.6CVE List
  • trigger.devunaffected: 4.5.6CVE List
  • trigger.dev, npmfrom first release, fixed in 4.5.6OSV

References 2