CVE-2026-114087: Improper Isolation or Compartmentalization in triggerdotdev trigger.dev
Description
Trigger.dev versions prior to 4.5.6 for self-hosted Docker Compose deployments are vulnerable to authentication bypass due to a hardcoded secret. This flaw allows unauthenticated attackers to forge valid magic link tokens and log in as any email address. Once authenticated, attackers can access Postgres, Redis, and ClickHouse services with default credentials, compromising all tenant data.
CVSS v4.0
Score 9.2critical
Affected software
triggerdotdev
trigger.dev
pkg:github/triggerdotdev/trigger.devRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-114087 describes an improper isolation or compartmentalization vulnerability in trigger.dev before version 4.5.6. The issue arises from the use of a hardcoded MAGIC_LINK_SECRET in default Docker Compose deployment secrets, enabling attackers to bypass authentication by forging magic link tokens. This unauthorized access extends to backend services such as Postgres, Redis, and ClickHouse, which are accessible with default credentials from runner containers on infrastructure networks, leading to full tenant data compromise.
Potential Impact
The vulnerability allows unauthenticated attackers to impersonate any user by forging magic link tokens, bypassing authentication controls. Subsequently, attackers can access critical backend databases and caches (Postgres, Redis, ClickHouse) using default credentials, resulting in complete compromise of tenant data stored in these services.
Mitigation Recommendations
Upgrade trigger.dev to version 4.5.6 or later, where this vulnerability is fixed. Avoid using default secrets from hosting/docker/.env.example in production deployments. Replace hardcoded secrets with unique, securely generated values to prevent token forgery and unauthorized access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T21:46:05.992Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad80c062cdf04f6568caa43
Added to database: 10/21/2026, 00:49:10 UTC
Last enriched: 10/21/2026, 01:18:33 UTC
Last updated: 10/21/2026, 01:48:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.