CVE-2026-114073 Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114073?
CVE-2026-114073 is a medium-severity vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.
Official description
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
Weakness: CWE-532
Which versions are affected by CVE-2026-114073?
2 open source packages ship an affected version, including trigger.dev.
| Package | Affected | Fixed in |
|---|---|---|
trigger.dev npm | All versions | 4.5.9 |
trigger.dev npm | All versions | 4.5.9 |
How do I fix CVE-2026-114073?
Upgrade trigger.dev to 4.5.9 or later.
Is CVE-2026-114073 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114073 exists.
Sources
Also known as GHSA-45vw-83pv-f4m9, GHSA-fj2x-mqqp-3v2w, MINI-96p2-px88-6f4p.