Live › vulnerability › CVE-2026-114088
Go to dashboardTrigger.dev before 4.5.4 ships a default coordinator secret in its /coordinator Socket.IO namespace that is published openly. An unauthenticated attacker who connects with it can request decrypted run environment variables or send forged run-status events to alter arbitrary runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Trigger.dev deployments running a version before where the coordinator is reachable by untrusted clients are exposed. The sources do not say whether Trigger.dev Cloud is affected, so unknown. Teams that already run or later can skip it.
4.5.44.5.4No product ranges from the sources yet.
npx trigger.dev@latest --version or the version pinned in package.json) and see whether it is below 4.5.4.COORDINATOR_SECRET is set to a non-default value (the sources do not name the exact variable).4.5.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-114088")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.