CVE-2026-114069

Deferred Deferred - Pending Action

Improper Authorization in Trigger.dev Exposes Root API Key

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114069

EUVD

EUVD-2026-107020

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-114069 is an improper authorization vulnerability in Trigger.dev versions before 4.6.0. The GET /api/v1/projects/:projectRef/envvars endpoint exposes the environment's root API key (TRIGGER_SECRET_KEY) for staging, production, and preview environments when accessed with a restricted read:envvars permission. Attackers with this limited access can retrieve the root secret and plaintext secrets, enabling them to trigger tasks and mint admin public JWTs.

Detection Guidance

Check Trigger.dev server logs for unusual access to the /api/v1/projects/:projectRef/envvars endpoint with read:envvars scope. Monitor for requests from unauthorized IPs or excessive variable dumps. Verify API key permissions to ensure no restricted read:envvars keys exist with excessive access.

Impact Analysis

An attacker with a restricted read:envvars key could obtain the root secret and plaintext secrets. This allows them to trigger tasks, mint admin public JWTs, read all runs, and perform other privileged actions. The impact includes unauthorized access to sensitive data and system control.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of plaintext secrets and root keys may result in non-compliance with data security and privacy regulations.

Mitigation Strategies

Upgrade Trigger.dev to version 4.6.0 or later immediately. Revoke all restricted read:envvars API keys and replace them with least-privilege keys. Audit environment variables for exposed root secrets and rotate all compromised keys and secrets.

Hi! I’m here to help you understand CVE-2026-114069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...