CVE-2026-114073
Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 27, 2026
- Reserved
- Oct 20, 2026
Description
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
trigger.devtriggerdotdev |
|
References
- GitHub Security Advisory (GHSA-fj2x-mqqp-3v2w)vendor-advisory
- VulnCheck Advisory: Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.