CVE-2026-114087

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.6

Description Self-hosted deployments using the default secrets from hosting/docker/.env.example are susceptible to a multi-stage unauthenticated attack chain. The issue stems from hardcoded cryptographic secrets, specifically the MAGIC LINK SECRET, which allows an attacker to forge valid magic link tokens and authenticate as any email address. This authentication bypass enables attackers to access internal infrastructure networks. From runner containers, attackers can reach Postgres, Redis, and ClickHouse using default credentials, leading to a complete compromise of all tenant data, API keys, and encrypted secrets. The vulnerability is further exacerbated by the reuse of SESSION SECRET for JWT signing and the lack of authentication for Redis.

Recommendations Update Trigger.dev to version 4.5.6 or later. Change all default secrets provided in hosting/docker/.env.example, including MAGIC LINK SECRET, SESSION SECRET, and ENCRYPTION KEY, to unique, strong values. Update default credentials for Postgres and ClickHouse. Enable authentication for Redis.