Trigger.dev: Authentication bypass via hardcoded default secrets
Summary
Self-hosted Trigger.dev deployments before 4.5.6 that use the default secrets from hosting/docker/.env.example can be attacked without authentication. The hardcoded MAGIC_LINK_SECRET allows an attacker to forge magic link tokens and log in as any email address. From there, the attacker can reach the Postgres, Redis and ClickHouse services with default credentials from runner containers and access all tenant data.
Affected
- trigger.dev versions before 4.5.6 (GitHub advisory: 4.5.5 and earlier)
- Self-hosted Docker Compose deployments that use the default secrets from hosting/docker/.env.example
- Cloud-hosted Trigger.dev: not confirmed as affected by the sources
Fixed in
- Upgrade to trigger.dev 4.5.6 or later.
Workaround
No workaround documented in the sources.
Exploitation
- CISA SSVC: exploitation status is proof of concept; automatable: no; technical impact: total.
- Public advisories describe the exact steps to forge a magic link token with the known secret.
Our recommendation
- Upgrade all self-hosted instances to trigger.dev 4.5.6 or later.
- Replace all default secrets (MAGIC_LINK_SECRET, SESSION_SECRET, ENCRYPTION_KEY, MANAGED_WORKER_SECRET) and default database, Redis and ClickHouse credentials.
- Check whether self-hosted instances were exposed and review user accounts and logs for unknown email addresses.
- Keep runner containers off networks that reach the database and cache services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pqxw-g93w-hj9x github.com
- VulnCheck advisory: Trigger.dev before 4.5.6 www.vulncheck.com
- GitHub Advisory Database GHSA-pqxw-g93w-hj9x github.com
- OSV GHSA-pqxw-g93w-hj9x osv.dev
- GitLab Advisory Database mirror GHSA-pqxw-g93w-hj9x advisories.gitlab.com
- OpenCVE CVE-2026-114087 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:10.
Original description (NVD)
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.