CVE-2026-114073

MediumCVSS 5.5/10Last modified Oct 21, 2026

Description

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1140745.4Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SCVE-2026-1140755.4Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to cCVE-2026-1140765.4Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp serCVE-2026-1140777.1Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeploymeCVE-2026-1140788.1Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService thatCVE-2026-1140795.4Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel CVE-2026-114086.3A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMoCVE-2026-1140805.0Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the seCVE-2026-1140817.7Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into gCVE-2026-1140828.1Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain enviroCVE-2026-1140838.1Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authentCVE-2026-1140847.7Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags qu
CVE-2026-114073: Medium severity, CVSS 5.5 | Vulnix