CVE-2026-114073

Deferred Deferred - Pending Action

Trigger.dev CLI Debug Logs Expose Environment Secrets

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114073

EUVD

EUVD-2026-107024

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

CVE-2026-114073 is an information disclosure vulnerability in Trigger.dev CLI versions before 4.5.9. It exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover sensitive data like database connection strings and service credentials.

Detection Guidance

Check for debug deployment logs containing the 'Starting buildWorker' record. Run 'trigger.dev deploy --env staging --dry-run --log-level debug' to inspect if environment secrets are exposed in the output.

Impact Analysis

This vulnerability allows unauthorized individuals to access sensitive secrets such as database connection strings and service credentials. If attackers obtain these secrets, they could gain access to databases, services, or other protected resources, leading to data breaches, unauthorized actions, or further exploitation of systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach caused by this vulnerability may result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Upgrade trigger.dev CLI to version 4.5.9 or later. Avoid using debug log levels in production environments and review CI debug logs for exposed secrets.

Hi! I’m here to help you understand CVE-2026-114073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...