Trigger.dev self-hosted deployments before v4.5.4 expose three main vulnerabilities: (1) a hardcoded default authentication secret ('coordinator-secret') used by the /coordinator Socket.IO namespace, which is undocumented and widely deployed by default; (2) a handler that returns decrypted environment variables for any run ID to authenticated callers, exposing sensitive secrets; and (3) multiple coordinator handlers that accept attacker-controlled write operations on arbitrary runs without authorization checks. The vulnerabilities stem from legacy V1 Run Engine code and default secrets baked into source and configuration. The entire vulnerable V1 stack, including the default secrets and coordinator namespaces, was removed in v4.5.4, mitigating these issues. Managed cloud instances were not affected as they use unique secrets.

An attacker able to connect to the /coordinator Socket.IO namespace on a self-hosted Trigger.dev instance running versions before 4.5.4 with default configuration can exfiltrate decrypted environment variables containing sensitive secrets such as database credentials and API keys. They can also send forged messages to manipulate the state of arbitrary runs without authorization. This compromises confidentiality and integrity of the affected deployments. Managed cloud instances are not impacted.

Upgrade all self-hosted Trigger.dev instances to version 4.5.4 or later, which removes the vulnerable V1 execution stack, eliminates the hardcoded default secrets, and disables the insecure coordinator namespaces and handlers. Managed cloud users do not need to take action as their deployments were not affected. Operators should verify that no deployments are running versions prior to 4.5.4 with default secrets.