CVE-2026-114087

HighCVSS 8.1/10Last modified Oct 22, 2026

Description

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-653

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1140886.5Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticat CVE-2026-1140898.8Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/aut CVE-2026-114097.2An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitizat CVE-2026-1140907.1Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all CVE-2026-1140915.3Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the calle CVE-2026-1140926.5Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources CVE-2026-1140934.3Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by CVE-2026-1140948.8Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attack CVE-2026-1140956.5Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via CVE-2026-1140967.8Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to writ CVE-2026-1140977.8Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to writ CVE-2026-1140987.8Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files ou