EUVD-2026-106890
GHSA-jm68-q9wf-qf39
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed self-hosted instance
-
DeliveryForge magic link with default secret
-
ExploitAuthenticate as arbitrary email
-
ExecutionPivot to Postgres/Redis/ClickHouse on internal network
-
ImpactExfiltrate all tenant data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Exploitation Conditions | Requires a self-hosted Trigger.dev v4 instance deployed via the provided Docker Compose config using the unmodified MAGIC_LINK_SECRET (44da78b7bbb0dfe709cf38931d25dcdd) from hosting/docker/.env.example, and with WHITELISTED_EMAILS unset (the self-hosted default) so accounts auto-create on first login. No user interaction or authentication is needed and default configurations are exploitable, but exploitation is LIMITED to deployments that never rotated the example secrets - the hosted SaaS product and any instance with regenerated secrets or an email allowlist are not affected. Full database pivot additionally relies on the default Postgres/Redis/ClickHouse credentials shipped in the same compose files. |
| Impact | This is a genuine high-priority issue for the specific population that is vulnerable, not an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact on the vulnerable system, scoring 9.2. The single mitigating signal is AT:P (attack requirements present): exploitation only works when the operator deploys self-hosted Docker Compose using the unmodified default secrets from hosting/docker/.env.example - the SaaS/cloud product and any deployment that rotated secrets are unaffected. Working exploit code is published directly in the GHSA advisory (POC=YES), so weaponization effort is near zero, but there is no CISA KEV listing and no EPSS score in the provided data, so I cannot assert active exploitation. Net: publicly available exploit code exists against a well-defined, operator-dependent condition - treat as urgent for any self-hosted v4 instance but recognize that scope is bounded by how many operators left defaults in place. EPSS is absent, so probabilistic exploitation likelihood could not be weighed. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable self-hosted Trigger.dev v4 instance and, knowing the hardcoded MAGIC_LINK_SECRET that ships in the public repo's .env.example, uses the published POC to encrypt a magic-link token for any email they choose. They hit /magic?token=... and receive a valid session cookie, auto-creating an admin-capable account, then pivot from the authenticated webapp/runner network to Postgres, Redis, and ClickHouse which all use default credentials, dumping every tenant's data. Full working exploit code and reproduction steps are published in the GHSA advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected.
RemediationAI
Vendor-released patch: upgrade to trigger.dev 4.5.6 (PR https://github.com/triggerdotdev/trigger.dev/pull/4316, commit https://github.com/triggerdotdev/trigger.dev/commit/6997aeb05e27d2db47f9eda01fdc8a17c81a1ae0) and redeploy the webapp and worker services. Immediately rotate SESSION_SECRET, MAGIC_LINK_SECRET, ENCRYPTION_KEY, and MANAGED_WORKER_SECRET in the .env file; this invalidates existing sessions and any previously issued magic links, so users must re-authenticate. Set WHITELISTED_EMAILS to an explicit allowlist to prevent auto-creation of arbitrary accounts, with the trade-off that new legitimate users outside the list cannot self-register. Replace the default Postgres, Redis, and ClickHouse credentials in the Compose files and restart dependent services; changing these credentials requires coordinated updates to every service that connects to those data stores. Restrict the runner containers' network access to only the services they require, or place data stores on a separate network, acknowledging that overly tight isolation can break job execution. Review existing sessions and user records for unauthorized accounts, and consult the advisory at https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqxw-g93w-hj9x.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Trigger.dev v4 self-hosted deployments use remix-auth-email-link@2.0.2 to generate passwordless magic-link tokens, encrypting a JSON payload (email and timestamp) with CryptoJS AES using the MAGIC_LINK_SECRET. The example Compose environment ships a fixed MAGIC_LINK_SECRET, and trigger.dev does not override the library's validateSessionMagicLink default of false, so a token forged with that secret is accepted without out-of-band validation. When WHITELISTED_EMAILS is unset-the default for self-hosted-the application auto-creates a user for the forged email and issues a session cookie. CWE-653 (Improper Isolation or Compartmentalization) reflects the broader design weakness: the same Compose network places Postgres, Redis, and ClickHouse within reach of runner containers, and the example files ship default infrastructure passwords, so an application-level auth bypass can cross into database and cache layers. The CPE cpe:2.3:a:triggerdotdev:trigger.dev:*:*:*:*:*:*:*:* covers the affected npm package through 4.5.5.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network auth-bypass (PR:N/UI:N) with full CIA impact; AC:H because exploitation depends on the target running unmodified default secrets, a condition outside the attacker's control.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
Articles & Coverage 1
Technical POC Analysis
CWE-653, Improper Isolation or Compartmentalization; the advisory also cites CWE-1393, Use of Default Password.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) that retain example secrets are exposed to an authentication bypass that can let attackers impersonate any user and access or modify tenant data; publicly available exploit code exists. Because default Postgres, Redis, and ClickHouse credentials may be reachable from runner containers, a compromised instance can escalate to broader infrastructure compromise. Hosted SaaS and instances with regenerated secrets or an email allowlist are not affected, so leadership should prioritize containment for Docker Compose deployments still using example secrets.
No vendor-released patch identified at time of analysis; interim mitigations include rotating MAGIC_LINK_SECRET from the hosting/docker/.env.example default, setting WHITELISTED_EMAILS to an explicit allowlist, rotating default Postgres, Redis, and ClickHouse credentials, and restricting Docker network access to runner containers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Trigger.dev Authorization and Injection Flaws
View all 29An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB