CVE-2026-114088

Deferred Deferred - Pending Action

Hardcoded Secret in Trigger.dev Coordinator Socket.IO

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114088

EUVD

EUVD-2026-106891

Affected Vendors & Products

Vendor	Product	Version / Range
triggerdotdev	trigger.dev	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

CVE-2026-114088 is a hardcoded default secret vulnerability in Trigger.dev versions before 4.5.4. It allows unauthenticated attackers to connect to the /coordinator Socket.IO namespace using a published coordinator-secret value. Attackers can then emit specific events to retrieve decrypted run environment variables or tamper with arbitrary task runs.

Detection Guidance

Check if your Trigger.dev instance is running a version before 4.5.4. Inspect network traffic for unauthorized connections to the /coordinator Socket.IO namespace. Look for events like READY_FOR_EXECUTION or TASK_RUN_FAILED_TO_RUN being emitted without proper authentication.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data like decrypted environment variables. Attackers may also manipulate task runs, causing incorrect execution or failures. Systems using affected versions are at risk of data breaches and operational disruptions.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive data (e.g., environment variables) and allowing unauthorized modifications to systems handling protected information. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.4 or later immediately. For self-hosted instances, ensure the coordinator-secret is not hardcoded and is properly secured. Review and restrict access to the /coordinator Socket.IO namespace.

Hi! I’m here to help you understand CVE-2026-114088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...