CVE-2026-114073 in Trigger.dev
Summary
by MITRE • 10/21/2026
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The Trigger.dev Command Line Interface prior to version 4.5.9 contains a critical information disclosure vulnerability that stems from improper handling of sensitive environment variables during deployment operations. This flaw arises because the CLI serializes unredacted environment variable values into debug-level log outputs when initiating build workers. In secure software design, secret management practices dictate that credentials such as database connection strings, API keys, and service tokens must never be logged in plaintext, regardless of the verbosity level or operational context. The failure to mask these sensitive data points represents a fundamental deviation from established security protocols for handling confidential information within development tools.
From a technical perspective, the vulnerability is triggered when the deployment process begins execution of worker processes. During this phase, the system logs detailed diagnostic information intended for troubleshooting purposes. However, instead of sanitizing or obfuscating values associated with environment variables marked as secrets, the application includes their resolved plaintext contents in the output stream. This behavior allows any entity with access to these log files to extract highly sensitive configuration data directly from standard text records labeled as build worker initialization events. The persistence of this information in logs creates a long-term risk since such artifacts are often archived for auditing or support purposes, extending the window of exposure well beyond the initial deployment event.
The operational impact of this vulnerability is severe due to the nature of the exposed data. Attackers who gain access to terminal transcripts, continuous integration debug logs, or technical support bundles can recover database connection strings and service credentials without needing additional exploitation steps. The compromise of these secrets can lead directly to unauthorized access to backend systems, potential data breaches, and further lateral movement within an organization's infrastructure. Since CI/CD pipelines are central to modern software delivery, the leakage of credentials through build logs poses a systemic risk that affects not only the immediate application but also any downstream services dependent on those compromised credentials.
This vulnerability aligns with CWE-209, which classifies issues where an error condition exposes sensitive information to unauthorized actors, and specifically relates to CWE-798 regarding the use of hardcoded credentials or improper handling of secrets in configuration files. In terms of attack vectors, this falls under ATT&CK technique T1530, Data from Cloud Storage Object Discovery, as attackers often harvest logs stored in cloud repositories like GitHub Actions artifacts or AWS CodeBuild outputs to gather intelligence for subsequent attacks. The exposure mechanism is passive and does not require active exploitation beyond gaining read access to the log files themselves.
To mitigate this risk, organizations must immediately upgrade Trigger.dev CLI to version 4.5.9 or later where the serialization logic has been corrected to redact secret values from debug outputs. Additionally, security teams should audit historical logs for any instances of exposed credentials and rotate all affected secrets as a precautionary measure. Implementing strict log rotation policies that limit the retention period of verbose deployment logs can further reduce the attack surface by minimizing the time window during which these artifacts remain accessible to potential adversaries.