Key points
- The vulnerability affects all Trigger.dev versions before 4.6.0.
- Attackers with restricted read access can extract root secrets and plaintext environment variables.
- The flaw allows the creation of administrative JWTs and unauthorized task execution.
Trigger.dev versions earlier than 4.6.0 contain a high-severity authorization vulnerability identified as CVE-2026-114069. The National Vulnerability Database rates this flaw at 8.6 on the CVSS scale. The issue resides in the GET /api/v1/projects/:projectRef/envvars endpoint. This specific API route improperly handles authorization checks for environment variable requests. Consequently, the system fails to restrict access appropriately for users holding limited credentials.
In plain English
The vulnerability allows an attacker who possesses a restricted key with only read permissions for environment variables to bypass security controls. By accessing the specific API endpoint, the attacker can retrieve the root API key, labeled as TRIGGER_SECRET_KEY. This exposure applies to staging, production, and preview environments. Once the root secret is obtained, the attacker gains full control over the affected project. They can then trigger arbitrary tasks within the system. Additionally, the attacker can mint administrative public JSON Web Tokens. This effectively grants them the same privileges as a system administrator.
The background
The National Vulnerability Database classifies the weakness under CWE-269, which denotes improper privilege management. The flaw specifically impacts the endpoint responsible for returning environment variables for a given project reference. According to the advisory, the system returns sensitive data without verifying that the requesting key has sufficient permissions. This misconfiguration allows low-privilege keys to access high-value secrets. The vulnerability is present in all releases of Trigger.dev prior to version 4.6.0. No other software vendors or products are mentioned in the record.
What changes now
Users of Trigger.dev should upgrade to version 4.6.0 or later to address this vulnerability. The source material indicates that versions before 4.6.0 are affected, implying that 4.6.0 resolves the issue. Until systems are updated, any restricted key with read:envvars permissions represents a significant risk. Attackers can use these keys to compromise the entire environment. Organizations should verify their current version immediately. If the version is below 4.6.0, the system is vulnerable to exploitation.
Who needs to act first
Teams should prioritize updating systems that expose the Trigger.dev API to untrusted networks or external users. Check whether any restricted keys have been shared with third-party vendors or contractors, as these credentials now pose a severe risk. Before applying the update, back up current configurations and environment variables to prevent data loss during the migration process. Test the upgrade in a staging environment first to ensure no workflow disruptions occur. If immediate updating is not possible, revoke any existing restricted keys with read access to environment variables to limit potential exposure.
What to do and how to stay safe: Trigger.dev
- Verify your current Trigger.dev version and upgrade to 4.6.0 or later if you are running an older release.
- Audit all API keys associated with your projects and revoke any restricted keys that have read access to environment variables.
- Monitor your project logs for unusual activity, such as unexpected task triggers or new administrative token generation.
- Rotate your root API keys and other sensitive secrets once you have confirmed the system is patched and secure.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Trigger.dev versions are affected by CVE-2026-114069?
All versions of Trigger.dev prior to 4.6.0 are affected by this vulnerability.
Can an attacker use a restricted key to gain admin access?
Yes, an attacker with a restricted read:envvars key can obtain the root secret and mint administrative JWTs.
Is there a fix available for this vulnerability?
The source material states that versions before 4.6.0 are affected, indicating that 4.6.0 is the fixed version.
