ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-114087

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Published Oct 2, 2026 · catalog updated Oct 22, 2026 · Trigger.dev Self-Hosted Deployment: Default

Check this week

CVE-2026-114087 is not in CISA KEV. FIRST estimates a 35.00% chance of exploitation in the next 30 days. Check whether you run Trigger.dev Self-Hosted Deployment: Default.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Trigger.dev Self-Hosted Deployment: Default).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
35.00%
Remediation
Advisory link
Affected products
npm trigger.dev · vendor triggerdotdev

## Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. ## Vulnerability Details The file contains hardcoded cryptographic secrets: The is used by to create authentication tokens via CryptoJS AES encryption. An attacker who knows this secret can forge valid magic links that authenticate as any email address without email delivery. The option defaults to in the library (never overridden by trigger.dev), so no session-side validation occurs. User accounts are auto-created when is not set (the default for self-hosted). ## Steps to Reproduce ### Setup ### Step 1: Forge magic link token ### Step 2: Authenticate via forged magic link ### Step 3: Verify database access from runner network ### Step 4: Verify Redis access (no auth) ### Step 5: Verify ClickHouse access ## Root Cause 1. Hardcoded secrets in (lines 9-12) 2. Runner containers placed on infrastructure networks: in 3. Default credentials on all infrastructure services 4. No Redis authentication 5. SESSION_SECRET reused for JWT signing ( ) and impersonation tokens ## Impact Complete infrastructure compromise: all tenant data, API keys, encrypted secrets (decryptable with known ENCRYPTION_KEY), user accounts, cross-tenant access. Attacker can modify data, push backdoored Docker images to the registry, and manipulate job queues.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm trigger.dev0 → 4.5.6
  • vendor triggerdotdevversion unspecified

How to fix CVE-2026-114087

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-114087 is not in CISA KEV. FIRST estimates a 35.00% chance of exploitation in the next 30 days. Check whether you run Trigger.dev Self-Hosted Deployment: Default.

Which versions are affected?

Compare what you have installed with 0 → 4.5.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1393; CWE-653. EPSS 35.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Docker security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 2, 2026 · GitHub Advisory Database

    Detected

    ## Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. ## Vulnerability Details The file contains hardcoded cryptographic secrets: The is used by to create authentication tokens via CryptoJS AES encryption. An attack

  2. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    trigger.dev fixed in 4.5.6

  3. Oct 21, 2026 · GitHub Advisory Database

    Fix available

    trigger.dev fixed in 4.5.6

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ## Summary Self-hosted trigger.dev v4 instances deployed using the provided Docker Compose configuration with default secrets from are vulnerable to a multi-stage unauthenticated attack chain leading to complete infrastructure compromise. ## Vulnerability Details The file contains hardcoded cryptographic secrets: The is used by to create authentication tokens via CryptoJS AES encryption. An attack

  5. Oct 22, 2026 · EUVD

    Updated

    Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructur

Sources

  • CVE.orgVulnerability recordCVE-2026-114087

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2026-106890

    Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any em

    euvd.enisa.europa.eu
  • GitHub Advisory DatabasePackage advisoryGHSA-pqxw-g93w-hj9x

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-pqxw-g93w-hj9x

    Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

    osv.dev

References

Freshness

Last verified in this catalog Oct 22, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.