CVE-2026-114087

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

State: Published
Severity: 9.2 Critical
Published: Oct 21, 2026
Updated: Oct 22, 2026
Reserved: Oct 20, 2026

Description

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-653 Improper Isolation or Compartmentalization

Affected Products

Product	Versions
trigger.devtriggerdotdev	before 4.5.6Affected 4.5.6Not affected

References

GitHub Security Advisory (GHSA-pqxw-g93w-hj9x)vendor-advisory
VulnCheck Advisory: Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.