CVE-2026-114073
CVE-2026-114073 · Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
CVSS 6.8 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
trigger.dev
- Versions
- ≥ 0, < 4.5.9: Affected (semver)
- 4.5.9: Not affected (semver)
Update to 4.5.9
trigger.dev npm
- Affected ranges
- SEMVER: < 4.5.9
Update to 4.5.9