Trigger.dev: Improper authorization exposes environment root secret key
Summary
Trigger.dev before 4.6.0 has an improper authorization flaw in the GET /api/v1/projects/:projectRef/envvars endpoint. The endpoint returns the environment's root API key as TRIGGER_SECRET_KEY, together with plaintext environment variables, for staging, production and preview environments. An attacker with a restricted API key that has the read:envvars scope can obtain the root secret and then trigger tasks and mint admin public JWTs. Development environments are not affected.
Affected
- trigger.dev versions before 4.6.0 (CVE record: affected 0 to < 4.6.0)
- Lower bound of the affected range: Unknown.
- Affected environments: staging, production and preview (not development).
- Note: the GitHub advisory lists 'affected <= 4.6.0'; verify the exact boundary there.
Fixed in
- Upgrade to trigger.dev 4.6.0 or later.
Workaround
- No vendor workaround known.
- Restrict which parties hold API keys with read:envvars scope.
- Review API logs for calls to the envvars endpoint from unexpected sources.
Exploitation
- CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'.
- Not listed in KEV.
- No reports of exploitation in the wild found.
- The GitHub advisory describes a reproduction script; no separate public exploit found.
Our recommendation
- Check whether Trigger.dev is used, including self-hosted instances reachable from the internet.
- Upgrade to 4.6.0 or later.
- Review which API keys have read:envvars scope and remove unneeded keys.
- Rotate the TRIGGER_SECRET_KEY and other secrets stored as environment variables if exposure cannot be ruled out.
- Monitor API logs for envvars requests from unexpected sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4gjx-f5hj-678x github.com
- VulnCheck advisory: Trigger.dev Root Secret Disclosure via envvars API Endpoint www.vulncheck.com
- OpenCVE: CVE-2026-114069 app.opencve.io
- HOL Guard: CVE-2026-114069 hol.org
- Trigger.dev API keys documentation trigger.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:25.
Original description (NVD)
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.