CVE-2026-114073
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
Risk Assessment
Disclosure of credentials can enable an attacker to access the database and other services, leading to data breach and privilege escalation.
Recommendation
Update Trigger.dev CLI to version 4.5.9 or later. Immediately rotate exposed secrets and review logs for unauthorized access.
Other vulnerabilities in Trigger.dev CLI
Original NVD description (English source)
Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS