Key points
- CVE-2026-114088 allows unauthenticated access via a hardcoded secret.
- Attackers can retrieve decrypted environment variables from runs.
- The flaw affects Trigger.dev versions prior to 4.5.4.
Trigger.dev versions before 4.5.4 contain a hardcoded default secret that exposes the coordinator Socket.IO namespace to unauthenticated attackers. This vulnerability, tracked as CVE-2026-114088, allows remote actors to connect using a published secret value without valid credentials.
The flaw enables attackers to emit specific events such as READY_FOR_EXECUTION to retrieve decrypted run environment variables. They can also send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs, potentially disrupting workflows or injecting malicious data into the execution pipeline.
Vulnerability Details
The National Vulnerability Database rates CVE-2026-114088 with a CVSS score of 8.3, classifying it as high severity. The weakness is categorized under CWE-798, which relates to use of hardcoded credentials. The hardcoded secret resides in the /coordinator Socket.IO namespace, making it accessible to anyone who knows the published value.
Affected Environments
Only Trigger.dev installations running versions before 4.5.4 are affected by this specific vulnerability. Organizations using older releases face direct exposure to unauthenticated access. Users on version 4.5.4 or later are not impacted by this particular hardcoded secret issue.
Next steps
Teams should immediately inventory their Trigger.dev deployments to identify any instances running versions prior to 4.5.4. If older versions are in use, prioritize upgrading to 4.5.4 or newer to eliminate the hardcoded secret. Monitor logs for unauthorized connections to the coordinator namespace during the transition period.
Signals worth monitoring
Security teams should look for unusual Socket.IO connections to the coordinator namespace from unexpected IP addresses. Check for READY_FOR_EXECUTION events emitted without prior authentication steps. Look for sudden spikes in TASK_RUN_FAILED_TO_RUN events or unexpected changes in run outcomes. Verify that environment variable access logs match expected workflow triggers.
What to do and how to stay safe: Trigger.dev
- Audit all Trigger.dev instances to confirm they are running version 4.5.4 or later.
- Review network logs for unauthenticated connections to the coordinator Socket.IO endpoint.
- Monitor for anomalous READY_FOR_EXECUTION or TASK_RUN_FAILED_TO_RUN event patterns.
- Rotate any environment variables that may have been exposed during the vulnerability window.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-114088?
It is a high-severity vulnerability in Trigger.dev before 4.5.4 that involves a hardcoded default secret in the coordinator Socket.IO namespace.
Who is affected by this flaw?
Any organization using Trigger.dev versions prior to 4.5.4 is affected, as the hardcoded secret allows unauthenticated access.
Can attackers steal data with this bug?
Yes, attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables and tamper with arbitrary runs using other events.
