Trigger.dev Patch Fixes Unauthenticated Secret Exposure in Versions Before 4.5.4

Trigger.dev has released version 4.5.4 to address a security issue rated high severity by the US National Vulnerability Database. The vulnerability, tracked as CVE-2026-114088, exists in all versions of the automation platform before this update. It stems from a hardcoded default secret within the application’s architecture.

What happened

The US National Vulnerability Database records that Trigger.dev versions earlier than 4.5.4 contain a hardcoded default secret vulnerability. This flaw is located in the Socket.IO namespace designated as /coordinator. The issue allows any unauthenticated attacker to connect to this namespace using a published coordinator-secret value. No valid credentials are required to establish this connection.

Once connected, attackers can emit specific events to manipulate the system. They can send a READY_FOR_EXECUTION event to retrieve decrypted run environment variables. This exposes sensitive data stored within the automation workflows. Attackers can also emit events such as TASK_RUN_FAILED_TO_RUN. This capability allows them to tamper with arbitrary runs within the platform.

Why it matters

The US National Vulnerability Database assigns this flaw a CVSS score of 8.3, which falls into the high severity category. The underlying weakness is classified as CWE-798, indicating a use of hardcoded credentials. Because the secret is hardcoded and published, remote attackers do not need to bypass authentication mechanisms. This makes the exploitation straightforward for anyone with network access to the coordinator endpoint.

Exposure of decrypted environment variables can lead to broader account compromise. These variables often contain API keys, database passwords, or other sensitive secrets. Allowing unauthenticated tampering with execution runs disrupts operational integrity. Teams relying on Trigger.dev for critical workflows face immediate risk of data leakage.

What to watch

• Monitor for unexpected READY_FOR_EXECUTION events in logs.
• Look for anomalous TASK_RUN_FAILED_TO_RUN messages.
• Check for unauthorized connections to the /coordinator namespace.
• Review environment variable access patterns for irregularities.

Who needs to act first

IT managers should prioritize updating systems that handle sensitive environment variables. Teams usually begin by identifying exposed instances of the affected automation platform. It is wise to test the update in a non-production environment first. Backing up current configurations ensures a safe rollback option if issues arise. Reducing network exposure to the coordinator namespace can help mitigate risk while patches are deployed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Trigger.dev

• Verify which version of Trigger.dev is running on all servers.
• Compare your current version against 4.5.4 to determine if you are affected.
• Review access logs for the /coordinator Socket.IO namespace for unauthorized activity.
• Plan to upgrade to version 4.5.4 or later once the vendor provides an update.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Trigger.dev are affected by CVE-2026-114088?

All versions of Trigger.dev before 4.5.4 are affected by this vulnerability.

What can an attacker do with this flaw?

Attackers can retrieve decrypted environment variables and tamper with arbitrary runs.

Is this vulnerability considered critical?

No, the US National Vulnerability Database rates it as high severity with a CVSS score of 8.3.