{"id":"CVE-2026-114073","aliases":["EUVD-2026-107024","GHSA-45vw-83pv-f4m9","GHSA-fj2x-mqqp-3v2w"],"status":"published","title":"Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00228,"percentile":0.13725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2026-10-02T22:45:12Z","modified":"2026-10-29T02:30:28Z","fixes":[{"ecosystem":"npm","package":"trigger.dev","fixed_in":["4.5.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"trigger.dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5.8"},{"fixed":"4.5.9"}]}]},{"source":"osv","ecosystem":"npm","package":"trigger.dev","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.9"}]}]}],"products":[{"vendor":"triggerdotdev","product":"trigger.dev"}],"references":[{"url":"https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-fj2x-mqqp-3v2w","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/trigger-dev-cli-before-4.5.9-secret-exposure-via-debug-deployment-logs","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114073","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-45vw-83pv-f4m9"},{"url":"https://github.com/triggerdotdev/trigger.dev/pull/4420","tags":["web"]},{"url":"https://github.com/triggerdotdev/trigger.dev/commit/878c15811aca8339a751aa0c2211012db7a47ce5","tags":["web"]},{"url":"https://github.com/triggerdotdev/trigger.dev/releases/tag/v4.5.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fj2x-mqqp-3v2w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114073.json","tags":["advisory"]},{"url":"https://github.com/triggerdotdev/trigger.dev","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-114073","title":"Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","status":"published","published":"2026-10-21T00:36:43.726Z","modified":"2026-10-27T21:47:06.757Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-107024","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","status":"published","published":"2026-10-21T00:36:43Z","modified":"2026-10-27T21:47:06Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:22.052945Z"}],"ghsa":[{"id":"GHSA-45vw-83pv-f4m9","title":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes...","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","status":"published","published":"2026-10-21T03:32:21Z","modified":"2026-10-21T03:32:21Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:14:08.480034Z"},{"id":"GHSA-fj2x-mqqp-3v2w","title":"Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values","description":"Affected version: trigger.dev 4.5.3 (4.5.6 was advertised by the CLI but was not tested).\n\nA staging dry-run executed with `trigger.dev deploy --env staging --dry-run --log-level debug`. The debug output logged the complete build-worker options object. Its `envVars` property contained unredacted values for every resolved staging variable, including database connection strings and service credentials. The non-debug environment listing correctly hides values, so users can reasonably expect deployment logs not to print secrets.\n\nImpact: anyone with access to a developer terminal transcript, CI debug log, captured agent/tool output, or support bundle can recover deployment secrets even though no deployment occurs.\n\nReproduction:\n1. Configure a Trigger.dev project with a secret environment variable.\n2. Run the command above with an authenticated profile.\n3. Inspect the `Starting buildWorker` debug record.\n4. `options.envVars` contains the plaintext value.\n\nNo real credential is included in this report. The observed customer credentials are being rotated separately.\n\nSuggested remediation: never serialize `envVars` values in debug output; log names only or replace every value with a fixed marker. Add regression coverage for deploy, dry-run, and debug logging, and review adjacent debug records for resolved secrets.","status":"published","published":"2026-10-02T22:45:12Z","modified":"2026-10-02T22:45:13Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-114073","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","status":"published","published":"2026-10-21T01:17:31.21Z","modified":"2026-10-27T22:17:24.467Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:13:02.045979Z"}],"osv":[{"id":"CVE-2026-114073","title":"Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs","description":"Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.","status":"published","published":"2026-10-21T00:36:43.726Z","modified":"2026-10-29T02:30:28.996116893Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"GHSA-fj2x-mqqp-3v2w","title":"Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values","description":"Affected version: trigger.dev 4.5.3 (4.5.6 was advertised by the CLI but was not tested).\n\nA staging dry-run executed with `trigger.dev deploy --env staging --dry-run --log-level debug`. The debug output logged the complete build-worker options object. Its `envVars` property contained unredacted values for every resolved staging variable, including database connection strings and service credentials. The non-debug environment listing correctly hides values, so users can reasonably expect deployment logs not to print secrets.\n\nImpact: anyone with access to a developer terminal transcript, CI debug log, captured agent/tool output, or support bundle can recover deployment secrets even though no deployment occurs.\n\nReproduction:\n1. Configure a Trigger.dev project with a secret environment variable.\n2. Run the command above with an authenticated profile.\n3. Inspect the `Starting buildWorker` debug record.\n4. `options.envVars` contains the plaintext value.\n\nNo real credential is included in this report. The observed customer credentials are being rotated separately.\n\nSuggested remediation: never serialize `envVars` values in debug output; log names only or replace every value with a fixed marker. Add regression coverage for deploy, dry-run, and debug logging, and review adjacent debug records for resolved secrets.","status":"published","published":"2026-10-02T22:45:12Z","modified":"2026-10-21T10:57:26.665490472Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:46.39441Z"}]}}