Moyenne
6.5
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator...
CVE-2026-114088
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Références
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com