Trigger.dev: Authentication bypass via hardcoded default coordinator secret
Summary
Trigger.dev contains a hardcoded default secret for the /coordinator Socket.IO namespace. Its value is published in the source code, so an unauthenticated attacker who can reach a self-hosted instance with default configuration can connect to the namespace. The attacker can then read decrypted run environment variables, which may include production secrets, and alter run states such as marking attempts as failed. The managed cloud service is not affected.
Affected
- Self-hosted Trigger.dev before 4.5.4 (vendor advisory)
- Affected version ranges reported by third parties differ (for example 4.4.2 to 4.5.4 or up to 4.5.3); the vendor advisory lists all versions before 4.5.4
- Managed cloud (cloud.trigger.dev) is not affected according to the vendor
Fixed in
- Trigger.dev 4.5.4 and later. The vulnerable namespaces and the default secrets were removed.
Workaround
- Set unique, strong values for PROVIDER_SECRET and COORDINATOR_SECRET. This is an interim measure inferred from the advisory, not a vendor-stated workaround.
- Restrict network access to the webapp to trusted networks.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'partial'.
- A public proof-of-concept exploit chain is described in the vendor advisory.
- Active exploitation in the wild is unknown.
Our recommendation
- Check whether Trigger.dev is self-hosted in your environment and identify the installed version.
- Upgrade self-hosted instances to 4.5.4 or later as soon as possible.
- If an upgrade is not immediately possible, set unique secrets for PROVIDER_SECRET and COORDINATOR_SECRET and restrict network access.
- If exposure is suspected, rotate secrets stored in run environment variables and review run activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gg6r-gp4c-89hp github.com
- VulnCheck advisory www.vulncheck.com
- OSV GHSA-gg6r-gp4c-89hp osv.dev
- Trigger.dev v4.5.4 changelog trigger.dev
- Vulners CVE-2026-114088 vulners.com
- VulDB 423930 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:25.
Original description (NVD)
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.