CVE-2026-114073 triggerdotdev CVE debrief

Who should care

Defenders responsible for Trigger.dev deployments, especially those using versions 4.5.3 and below, should assess the impact of unredacted secret values in debug logs and prioritize verifying exposure of sensitive environment variables.

Why it matters

CVE-2026-114073 is a vulnerability in Trigger.dev that exposes resolved environment secret values in debug deployment logs. Defenders should prioritize verifying exposure of sensitive environment variables in Trigger.dev deployments, especially for versions 4.5.3 and below, and assess the impact of unredacted secret values in debug logs.

• Recovery of deployment secrets by anyone with access to developer terminal transcripts, CI debug logs, captured agent/tool output, or support bundles.
• Potential for unauthorized access to sensitive environment variables, including database connection strings and service credentials.

Technical summary

The Trigger.dev Trigger CLI debug deployment logs expose resolved environment secret values in versions 4.5.3 and below. When a staging dry-run is executed with `trigger.dev deploy --env staging --dry-run --log-level debug`, the complete build-worker options object is logged, including unredacted values for every resolved staging variable. This vulnerability allows anyone with access to developer terminal transcripts, CI debug logs, captured agent/tool output, or support bundles to recover deployment secrets. The non-debug environment listing correctly hides values, leading users to reasonably expect deployment logs not to print secrets.

Defensive priority

Defenders should prioritize verifying exposure of sensitive environment variables in Trigger.dev deployments, especially for versions 4.5.3 and below, and assess the impact of unredacted secret values in debug logs.

Recommended defensive actions

• Verify Trigger.dev deployments for exposure of sensitive environment variables, especially for versions 4.5.3 and below.
• Assess the impact of unredacted secret values in debug logs on the organization's security posture.
• Update Trigger.dev to version 4.5.9 or later to address the vulnerability.
• Review and update logging configurations to prevent sensitive information from being logged in debug mode.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Monitor relevant logs for exposed assets that need extra review.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully addressed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version (trigger.dev 4.5.3), the debug command that triggers the issue, and the impact of unredacted secret values in debug logs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.