PT-2026-120214

CVE-2026-114088

Published

2026-10-02

Updated

2026-10-21

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.4

Description Self-hosted installations contain a hardcoded default authentication secret in the /coordinator Socket.IO namespace. This allows unauthenticated attackers to connect using the default coordinator-secret value. Once connected, attackers can exploit the following:

Information Disclosure: By emitting the READY FOR EXECUTION event, attackers can retrieve decrypted environment variables for any run if they possess the runId. This specifically affects deployments still utilizing Run Engine 1.0.
Unauthorized Data Modification: Attackers can send events such as TASK RUN FAILED TO RUN, TASK RUN COMPLETED, TASK RUN COMPLETED WITH ACK, CHECKPOINT CREATED, or CREATE WORKER to tamper with arbitrary runs using attacker-supplied payloads. This is possible because the system fails to verify if the caller has authority over the runId or attemptId provided in the message.