CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114087?
CVE-2026-114087 is a critical vulnerability in triggerdotdev trigger.dev, published on 21 Oct 2026.
Official description
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
Weakness: CWE-653
Which versions are affected by CVE-2026-114087?
2 open source packages ship an affected version, including trigger.dev.
| Package | Affected | Fixed in |
|---|---|---|
trigger.dev npm | All versions | 4.5.6 |
trigger.dev npm | All versions | 4.5.6 |
How do I fix CVE-2026-114087?
Upgrade trigger.dev to 4.5.6 or later.
Is CVE-2026-114087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114087 exists.
Sources
Also known as GHSA-jm68-q9wf-qf39, GHSA-pqxw-g93w-hj9x, MINI-cj67-cf79-3qmc.