CVE-2026-114088 triggerdotdev CVE debrief

Who should care

Operators of self-hosted Trigger.dev instances, security teams responsible for monitoring and patching vulnerabilities, and developers using Trigger.dev in their applications should be aware of this vulnerability and take necessary actions to secure their environments.

Why it matters

CVE-2026-114088 is a critical vulnerability in Trigger.dev that allows unauthorized access to production secrets in self-hosted webapps with default configurations. Operators of self-hosted instances should verify their configurations and update to version 4.5.4 or later to address the issue.

• Verify self-hosted instance configurations to prevent unauthorized access to production secrets.
• Update to version 4.5.4 or later to address the hardcoded default authentication secret vulnerability.
• Restrict access to the /coordinator Socket.IO namespace to prevent unauthorized connections.

Technical summary

The Trigger.dev vulnerability involves a hardcoded default authentication secret in the /coordinator Socket.IO namespace. This allows unauthorized access to production secrets in self-hosted webapps with default configurations. The issue is addressed in version 4.5.4. The vulnerability is caused by the declaration of PROVIDER_SECRET and COORDINATOR_SECRET with default values in the source code, which are not documented in the self-hosting documentation or environment variable files. An attacker can exploit this vulnerability by connecting to the /coordinator Socket.IO namespace and retrieving the decrypted environment variables of any run whose internal ID they can find.

Defensive priority

Operators of self-hosted Trigger.dev instances should verify their configuration and update to version 4.5.4 or later to address the hardcoded default authentication secret vulnerability.

Recommended defensive actions

• Verify self-hosted Trigger.dev instance configurations to ensure the COORDINATOR_SECRET and PROVIDER_SECRET are not using default values.
• Update Trigger.dev to version 4.5.4 or later to address the hardcoded default authentication secret vulnerability.
• Review and document custom secrets and environment variables for self-hosted instances.
• Restrict access to the /coordinator Socket.IO namespace to prevent unauthorized connections.
• Monitor for suspicious connections and READY_FOR_EXECUTION requests in self-hosted Trigger.dev instances.

Evidence notes

The source corpus provides details on the hardcoded default authentication secret in Trigger.dev, specifically in the /coordinator Socket.IO namespace. The issue allows unauthorized access to production secrets in self-hosted webapps with default configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.