CVE-2026-114069
CVE-2026-114069 · Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.
CVSS 8.6 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
trigger.dev
- Versiones
- ≥ 0, < 4.6.0: Afectada (semver)
- 4.6.0: No afectada (semver)
Actualiza a 4.6.0