CVE-2026-114087: Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Q: Which deployments are affected?

Self-hosted Docker Compose deployments of Trigger.dev before 4.5.6 are affected if they use the default secrets supplied in hosting/docker/.env.example. The issue is tied to the hardcoded default MAGIC_LINK_SECRET.

Q: What does an attacker need to exploit this?

An attacker can exploit the issue remotely without authentication or user interaction by forging valid magic-link tokens. They can log in as any email address.

Q: What access can exploitation provide?

After bypassing authentication, an attacker can reach Postgres, Redis, and ClickHouse using default credentials available from runner containers on infrastructure networks. This can compromise all tenant data.

Q: How can I determine whether my deployment is exposed?

Check whether the deployment is self-hosted with Docker Compose, runs a version before 4.5.6, and still uses the default values from hosting/docker/.env.example, particularly the MAGIC_LINK_SECRET. Deployments meeting those conditions are exposed.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Self-hosted Docker Compose deployments of Trigger.dev before 4.5.6 are affected if they use the default secrets supplied in hosting/docker/.env.example. The issue is tied to the hardcoded default MAGIC_LINK_SECRET.

What does an attacker need to exploit this?

An attacker can exploit the issue remotely without authentication or user interaction by forging valid magic-link tokens. They can log in as any email address.

What access can exploitation provide?

After bypassing authentication, an attacker can reach Postgres, Redis, and ClickHouse using default credentials available from runner containers on infrastructure networks. This can compromise all tenant data.

How can I determine whether my deployment is exposed?

Check whether the deployment is self-hosted with Docker Compose, runs a version before 4.5.6, and still uses the default values from hosting/docker/.env.example, particularly the MAGIC_LINK_SECRET. Deployments meeting those conditions are exposed.

CVE-2026-114087: Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What access can exploitation provide?

How can I determine whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this?

What access can exploitation provide?

How can I determine whether my deployment is exposed?