CVE-2026-114069
CVE-2026-114069 · Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.
CVSS 8.6 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.6.0: Affected (semver)
- 4.6.0: Not affected (semver)
Update to 4.6.0