CVE-2026-114088: Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Q: Who is exposed to this issue?

Trigger.dev deployments running a version before 4.5.4 are exposed if an attacker can reach the /coordinator Socket.IO namespace. The issue does not require an authenticated application user because the coordinator secret is published and hardcoded.

Q: What can an attacker do after connecting?

An attacker can emit READY_FOR_EXECUTION to obtain decrypted run environment variables. They can also send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

Q: What version addresses the vulnerability?

Upgrade Trigger.dev to version 4.5.4 or later. Versions before 4.5.4 are affected.

Published Oct 21, 2026

Updated

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READYFOREXECUTION to retrieve decrypted run environment variables or send TASKRUNFAILEDTORUN and similar events to tamper with arbitrary runs.

Affected Software

1 affected component

Trigger.dev Trigger.dev<4.5.4

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Trigger.dev deployments running a version before 4.5.4 are exposed if an attacker can reach the /coordinator Socket.IO namespace. The issue does not require an authenticated application user because the coordinator secret is published and hardcoded.

What can an attacker do after connecting?

An attacker can emit READY_FOR_EXECUTION to obtain decrypted run environment variables. They can also send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

What version addresses the vulnerability?

Upgrade Trigger.dev to version 4.5.4 or later. Versions before 4.5.4 are affected.

CVE-2026-114088: Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do after connecting?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do after connecting?

What version addresses the vulnerability?