CVE-2026-114069: Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Q: What level of access does an attacker need to exploit this issue?

The attacker needs a restricted API key with the read:envvars permission. No user interaction is required, and the vulnerable endpoint is reachable over the network.

Q: Which environments can expose the root API key?

The endpoint returns TRIGGER_SECRET_KEY for staging, production, and preview environments. It also exposes plaintext secrets available through the environment-variables API.

Q: What could an attacker do after obtaining the disclosed secret?

An attacker can use the root secret to trigger tasks and mint administrator public JWTs. This can lead to disclosure of secrets and high-impact unauthorized actions within the affected project.

Q: How can I determine whether my deployment is affected?

Deployments running Trigger.dev versions before 4.6.0 are affected. Review API keys granted read:envvars access, especially for projects with staging, production, or preview environments.

Published Oct 21, 2026

Updated

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev to a version that resolves this vulnerability.
Fixed in 4.6.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker needs a restricted API key with the read:envvars permission. No user interaction is required, and the vulnerable endpoint is reachable over the network.

Which environments can expose the root API key?

The endpoint returns TRIGGER_SECRET_KEY for staging, production, and preview environments. It also exposes plaintext secrets available through the environment-variables API.

What could an attacker do after obtaining the disclosed secret?

An attacker can use the root secret to trigger tasks and mint administrator public JWTs. This can lead to disclosure of secrets and high-impact unauthorized actions within the affected project.

How can I determine whether my deployment is affected?

Deployments running Trigger.dev versions before 4.6.0 are affected. Review API keys granted read:envvars access, especially for projects with staging, production, or preview environments.

CVE-2026-114069: Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which environments can expose the root API key?

What could an attacker do after obtaining the disclosed secret?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which environments can expose the root API key?

What could an attacker do after obtaining the disclosed secret?

How can I determine whether my deployment is affected?