Is CVE-2026-114069 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114069 being exploited in the wild.

How severe is CVE-2026-114069?

High severity, with a CVSS score of 8.1, published 21 October 2026.

Is there a fix for CVE-2026-114069?

Yes: fixed in 4.6.0 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114069 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-114069?

Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114069: Trigger.dev improper authorization in API environment variables endpoint

CVE-2026-114069 · Severity: high · CVSS 8.1 · Published 2026-10-21

Trigger.dev is a workflow automation platform that manages environment variables and API credentials. A vulnerability in the environment variables API endpoint allows attackers with restricted read-only API keys to obtain the environment's root secret and all plaintext secrets, then use them to trigger tasks, deploy code, and create administrative credentials. This affects staging, production, and preview environments.

Technologies: Trigger.dev. Vendors: Trigger.dev.

Quick answers

Is CVE-2026-114069 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114069 being exploited in the wild.
How severe is CVE-2026-114069?: High severity, with a CVSS score of 8.1, published 21 October 2026.
Which products and versions are affected?: Trigger.dev before 4.6.0.
Is there a fix for CVE-2026-114069?: Yes: fixed in 4.6.0 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114069 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-114069?: Check whether you run Trigger.dev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.6.0 and later

Technical details

The GET /api/v1/projects/:projectRef/envvars endpoint returns the environment's root API key (TRIGGER_SECRET_KEY) to any caller with read:envvars scope, including restricted additional keys that should only access environment variables. The vulnerable resolveVariablesForEnvironment() function injects the root key for all non-development environments. An attacker with a restricted Variables-only additional key can call this endpoint to obtain the root tr_prod/tr_stg/tr_preview credential and use it for full environment access including task triggering, webhook rotation, and JWT minting.

Affected products

Trigger.dev Trigger.dev before 4.6.0

Timeline

2026-09-14: disclosed
2026-10-21: advisory
2026-10-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.