{"id":"CVE-2026-114073","kind":"vulnerability","aliases":["CVE-2026-114073"],"related":[],"title":"Trigger.dev CLI: debug logs leak resolved environment secrets to readers","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","summary":"The Trigger.dev CLI before 4.5.9 writes unredacted environment variables into its debug deployment logs. Anyone who can read terminal transcripts, CI debug logs or support bundles can recover database connection strings and service credentials.","severity":"medium","cvss":6.8,"epss":0.00126,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","package","self-hosted","trigger.dev"],"not_affected_if":["cli-at-4.5.9-or-later"],"how_to_check":"- Run `npx trigger.dev@latest --version` or check the installed CLI version in the project's lockfile and compare against `4.5.9`\n- Search existing CI debug logs and support bundles for the `Starting buildWorker` record and look for secret values in its envVars","fix":"- Upgrade the Trigger.dev CLI to `4.5.9` or later\n- Rotate any database connection strings and service credentials that appeared in deployment debug logs or support bundles","status":"open","published_at":"2026-10-21T01:17:31+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:43:00+00:00","updated_at":"2026-10-25T03:43:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:43:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Trigger.dev CLI to `4.5.9` or later\n- Rotate any database connection strings and service credentials that appeared in deployment debug logs or support bundles","reach":"local","title":"Trigger.dev CLI: debug logs leak resolved environment secrets to readers","impact":"medium","summary":"The Trigger.dev CLI before 4.5.9 writes unredacted environment variables into its debug deployment logs. Anyone who can read terminal transcripts, CI debug logs or support bundles can recover database connection strings and service credentials.","category":"package","nicknames":[],"who_cares":["trigger.dev","ci-cd","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Database credentials and service secrets readable from debug logs","analyst_note":"","how_to_check":"- Run `npx trigger.dev@latest --version` or check the installed CLI version in the project's lockfile and compare against `4.5.9`\n- Search existing CI debug logs and support bundles for the `Starting buildWorker` record and look for secret values in its envVars","needs_analyst":false,"not_affected_if":["cli-at-4.5.9-or-later"],"who_is_affected":"Teams that deploy with the Trigger.dev CLI and keep debug deployment logs, CI logs or support bundles that others can read. Exposure depends on whether secrets were resolved into the build environment and whether those logs were shared or retained. Teams on 4.5.9 or later, or who do not run the CLI in deployment, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3377,"output_tokens":577,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114073':13A,16A '-2026':12A,15A '4.5.9':29B,62C 'access':84C 'anyon':39B 'attack':82C 'buildwork':98C 'bundl':50B,93C 'cd':19B 'ci':18B,45B,88C 'ci-cd':17B 'cli':2A,27B,60C 'connect':54B,103C 'contain':63C 'credenti':58B,107C 'cve':11A,14A 'databas':53B,102C 'debug':3A,36B,46B,75C,89C 'deploy':37B,76C 'disclosur':66C 'environ':7A,32B,71C 'envvar':81C 'expos':69C 'host':23B 'inform':65C 'leak':5A 'log':4A,38B,47B,77C,90C 'packag':20B 'read':42B,95C 'reader':10A 'record':99C 'recov':52B,101C 'resolv':6A,70C 'secret':8A,72C 'self':22B 'self-host':21B 'serial':79C 'servic':57B,106C 'start':97C 'string':55B,104C 'support':49B,92C 'termin':43B,86C 'transcript':44B,87C 'trigger.dev':1A,24B,26B,59C 'unredact':31B,80C 'valu':73C 'variabl':33B 'vulner':67C 'write':30B","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy with the Trigger.dev CLI and keep debug deployment logs, CI logs or support bundles that others can read. Exposure depends on whether secrets were resolved into the build environment and whether those logs were shared or retained. Teams on 4.5.9 or later, or who do not run the CLI in deployment, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114073","severity":null,"published_at":"2026-10-21T01:17:31+00:00","modified_at":"2026-10-21T01:17:31+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114073","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114073","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}