CVE-2026-114073: Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

Q: Who can recover exposed secrets?

Anyone who can access terminal transcripts, CI debug logs, or support bundles containing the debug deployment output can read the Starting buildWorker record and recover resolved environment secret values, including database connection strings and service credentials.

Q: What must occur for the exposure to happen?

The affected CLI must produce debug deployment logs. The exposure results from unredacted envVars being serialized into the Starting buildWorker log record.

Q: Which versions should be remediated?

Trigger.dev CLI versions before 4.5.9 are affected. Upgrade to version 4.5.9 or later.

Q: How can teams determine whether secrets may already have leaked?

Review retained terminal transcripts, CI debug logs, and support bundles for debug deployment output, particularly Starting buildWorker records. Treat any resolved environment values found there as exposed.

Published Oct 21, 2026

Updated

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

Affected Software

1 affected component

Trigger.dev Trigger.dev CLI<4.5.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Trigger.dev CLI to a version that resolves this vulnerability.
Fixed in 4.5.9

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can recover exposed secrets?

Anyone who can access terminal transcripts, CI debug logs, or support bundles containing the debug deployment output can read the Starting buildWorker record and recover resolved environment secret values, including database connection strings and service credentials.

What must occur for the exposure to happen?

The affected CLI must produce debug deployment logs. The exposure results from unredacted envVars being serialized into the Starting buildWorker log record.

Which versions should be remediated?

Trigger.dev CLI versions before 4.5.9 are affected. Upgrade to version 4.5.9 or later.

How can teams determine whether secrets may already have leaked?

Review retained terminal transcripts, CI debug logs, and support bundles for debug deployment output, particularly Starting buildWorker records. Treat any resolved environment values found there as exposed.

CVE-2026-114073: Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can recover exposed secrets?

What must occur for the exposure to happen?

Which versions should be remediated?

How can teams determine whether secrets may already have leaked?

Company

Resources

Contact

Frequently Asked Questions

Who can recover exposed secrets?

What must occur for the exposure to happen?

Which versions should be remediated?

How can teams determine whether secrets may already have leaked?