---
id: "CVE-2026-114073"
kind: "vulnerability"
aliases: ["CVE-2026-114073"]
title: "Trigger.dev CLI: debug logs leak resolved environment secrets to readers"
severity: "medium"
cvss: 6.8
epss: 0.00126
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci-cd", "package", "self-hosted", "trigger.dev"]
not_affected_if: ["cli-at-4.5.9-or-later"]
published_at: "2026-10-21T01:17:31+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:43:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114073", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114073", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Trigger.dev CLI: debug logs leak resolved environment secrets to readers

The Trigger.dev CLI before 4.5.9 writes unredacted environment variables into its debug deployment logs. Anyone who can read terminal transcripts, CI debug logs or support bundles can recover database connection strings and service credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npx trigger.dev@latest --version` or check the installed CLI version in the project's lockfile and compare against `4.5.9`
- Search existing CI debug logs and support bundles for the `Starting buildWorker` record and look for secret values in its envVars

## Fix

- Upgrade the Trigger.dev CLI to `4.5.9` or later
- Rotate any database connection strings and service credentials that appeared in deployment debug logs or support bundles

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114073
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114073

## From the sources

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_