Live › vulnerability › CVE-2026-114073
Go to dashboardThe Trigger.dev CLI before 4.5.9 writes unredacted environment variables into its debug deployment logs. Anyone who can read terminal transcripts, CI debug logs or support bundles can recover database connection strings and service credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deploy with the Trigger.dev CLI and keep debug deployment logs, CI logs or support bundles that others can read. Exposure depends on whether secrets were resolved into the build environment and whether those logs were shared or retained. Teams on 4.5.9 or later, or who do not run the CLI in deployment, can skip it.
No product ranges from the sources yet.
npx trigger.dev@latest --version or check the installed CLI version in the project's lockfile and compare against 4.5.9Starting buildWorker record and look for secret values in its envVars4.5.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-114073")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.