Medium
6.5
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator...
CVE-2026-114088
First seen on SecPulse
Original description The description as published by the source.
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.
Source: NIST National Vulnerability Database NVD GitHub Advisory
References
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com