Trigger.dev CVE-2026-114087

Requires a self-hosted Trigger.dev v4 instance deployed via the provided Docker Compose config using the unmodified MAGIC_LINK_SECRET (44da78b7bbb0dfe709cf38931d25dcdd) from hosting/docker/.env.example, and with WHITELISTED_EMAILS unset (the self-hosted default) so accounts auto-create on first login. No user interaction or authentication is needed and default configurations are exploitable, but exploitation is LIMITED to deployments that never rotated the example secrets - the hosted SaaS product and any instance with regenerated secrets or an email allowlist are not affected. Full database pivot additionally relies on the default Postgres/Redis/ClickHouse credentials shipped in the same compose files.

This is a genuine high-priority issue for the specific population that is vulnerable, not an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact on the vulnerable system, scoring 9.2. The single mitigating signal is AT:P (attack requirements present): exploitation only works when the operator deploys self-hosted Docker Compose using the unmodified default secrets from hosting/docker/.env.example - the SaaS/cloud product and any deployment that rotated secrets are unaffected. Working exploit code is published directly in the GHSA advisory (POC=YES), so weaponization effort is near zero, but there is no CISA KEV listing and no EPSS score in the provided data, so I cannot assert active exploitation. Net: publicly available exploit code exists against a well-defined, operator-dependent condition - treat as urgent for any self-hosted v4 instance but recognize that scope is bounded by how many operators left defaults in place. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

An attacker locates an internet-reachable self-hosted Trigger.dev v4 instance and, knowing the hardcoded MAGIC_LINK_SECRET that ships in the public repo's .env.example, uses the published POC to encrypt a magic-link token for any email they choose. They hit /magic?token=... and receive a valid session cookie, auto-creating an admin-capable account, then pivot from the authenticated webapp/runner network to Postgres, Redis, and ClickHouse which all use default credentials, dumping every tenant's data. Full working exploit code and reproduction steps are published in the GHSA advisory.