Trigger.dev Flaw Lets Restricted Keys Expose Root Secrets and Admin Tokens

Trigger.dev versions prior to 4.6.0 contain an improper authorization vulnerability that exposes sensitive credentials. The National Vulnerability Database records this flaw as CVE-2026-114069 with a CVSS score of 8.6, classifying it as high severity.

What happened

The vulnerability resides in the GET /api/v1/projects/:projectRef/envvars endpoint within the Trigger.dev platform. According to the NVD record, this endpoint fails to properly restrict access to environment variables. An attacker who possesses a restricted read:envvars key can exploit this flaw to retrieve the environment's root API key.

This root key is identified in the documentation as TRIGGER_SECRET_KEY. The exposure applies to staging, production, and preview environments alike. Once the attacker obtains this root secret, they can also access other plaintext secrets stored within those environments. The improper authorization weakness is mapped to CWE-269 by the National Vulnerability Database.

Why it matters

Access to the root secret grants an attacker the ability to trigger tasks within the affected environments. Beyond task execution, the compromised credentials allow the attacker to mint administrative public JWTs. This elevates the threat from simple data exfiltration to full administrative control over the platform's operations.

The impact spans all environment types supported by the platform, including preview, staging, and production. Security teams managing Trigger.dev instances must consider any restricted key a potential vector for full account takeover. The ability to generate admin tokens means lateral movement and persistent access are possible without further credential theft.

Our take on the response

• Verify the current version of all Trigger.dev installations against the 4.6.0 threshold.
• Audit existing API keys to identify any that hold the read:envvars permission.
• Rotate all root API keys and plaintext secrets if any restricted keys have been exposed.
• Review logs for unauthorized access attempts to the /api/v1/projects/:projectRef/envvars endpoint.

What defenders should look for

Teams usually monitor API gateway logs for unusual access patterns to sensitive endpoints. Check whether any service accounts with minimal privileges are accessing environment variable endpoints more frequently than expected. Look for spikes in authentication events that result in the creation of new administrative tokens. If such activity is detected, immediately isolate the affected environment and revoke the compromised credentials to prevent further lateral movement.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Trigger.dev

• Identify all instances of Trigger.dev running versions earlier than 4.6.0 in your infrastructure.
• Inventory all API keys with read:envvars permissions and assess their current usage and exposure risk.
• Prepare to rotate root API keys and associated secrets once the vendor provides an update.
• Implement stricter network controls to limit access to the /api/v1/projects/:projectRef/envvars endpoint.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Trigger.dev are affected by CVE-2026-114069?

All versions of Trigger.dev before 4.6.0 are affected by this improper authorization vulnerability.

What can an attacker do with a restricted read:envvars key in this scenario?

An attacker can obtain the root secret, plaintext secrets, trigger tasks, and mint admin public JWTs.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-114069 as 8.6 HIGH.