CVE-2026-114069

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.6.0

Description An improper authorization issue exists in the GET '/api/v1/projects/:projectRef/envvars' endpoint. This flaw allows users with a restricted read:envvars key to obtain the root API key, identified as TRIGGER SECRET KEY, as well as plaintext secrets for staging, production, and preview environments. An attacker with this access can trigger tasks and mint admin public JWTs (JSON Web Tokens), which are compact, URL-safe means of representing claims to be transferred between two parties.

Recommendations Update to version 4.6.0 or later. Restrict access to the '/api/v1/projects/:projectRef/envvars' endpoint to minimize the risk of exploitation.