What’s Vulnerable › Vulnerabilities

CVE-2026-114073: Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-27
• Weakness: CWE-532

Description

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

Affected products

• Npm Trigger.Dev: before 4.5.9 — fixed in 4.5.9
• triggerdotdev trigger.dev: before 4.5.9 — fixed in 4.5.9

How to fix

Upgrade to a fixed version: Npm Trigger.Dev 4.5.9; triggerdotdev trigger.dev 4.5.9. Check the vendor advisory for mitigations.

References

• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fj2x-mqqp-3v2w
• https://www.vulncheck.com/advisories/trigger-dev-cli-before-4.5.9-secret-exposure-via-debug-deployment-logs
• https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fj2x-mqqp-3v2w

Get alerted when CVE-2026-114073 or the next vulnerability affects your stack