Live › vulnerability › CVE-2026-114069
Go to dashboardTrigger.dev before 4.6.0: GET /api/v1/projects/:projectRef/envvars authenticates with read:envvars but returns the environment's root key as TRIGGER_SECRET_KEY (staging, production, preview) plus plaintext secrets. A leaked restricted key (e.g. the Cloud 'Variables only' preset) becomes full environment access: trigger tasks, deploy, mint admin JWTs. Dev environments are not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| trigger.dev | npm | >= 0, < 4.6.0 | 4.6.0 |
4.6.0)Variables only preset or custom policies with read:envvars4.6.0 or later (4.7.7 is the latest seen)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114069")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.