CVE-2026-114087

Deferred Deferred - Pending Action

Authentication Bypass in Trigger.dev Docker Compose Deployments

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114087

EUVD

EUVD-2026-106890

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-653	The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

Executive Summary

This vulnerability affects Trigger.dev versions before 4.5.6 when deployed using Docker Compose with default secrets. The issue stems from hardcoded cryptographic secrets in the .env.example file, particularly the MAGIC_LINK_SECRET. An attacker can forge valid authentication tokens to bypass login and access the system as any user without email verification. This allows unauthenticated access to databases like Postgres, Redis, and ClickHouse using default credentials.

Detection Guidance

Check if your trigger.dev Docker Compose deployment uses default secrets from hosting/docker/.env.example. Inspect the .env file for hardcoded values like MAGIC_LINK_SECRET, SESSION_SECRET, ENCRYPTION_KEY, and MANAGED_WORKER_SECRET. Verify if the MAGIC_LINK_SECRET matches the known vulnerable value '44da78b7bbb0dfe709cf38931d25dcdd'.

Impact Analysis

Unauthenticated attackers can log in as any user, modify data, push malicious Docker images, manipulate job queues, and access sensitive databases (Postgres, Redis, ClickHouse) using default credentials. This could lead to complete infrastructure compromise and data theft or corruption.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized access to sensitive data, lack of proper authentication, and potential data breaches. Organizations using affected versions may face legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Upgrade trigger.dev to version 4.5.6 or later. Regenerate all secrets in the .env file with strong, unique values. Ensure WHITELISTED_EMAILS is configured to restrict user registration. Restart all Docker containers after updating secrets.

Hi! I’m here to help you understand CVE-2026-114087. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...