Vulnerability Description
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqxw-g93w-
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-authentication-byp
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-pqxw-g93w-
FAQ
What is CVE-2026-114087?
CVE-2026-114087 is a vulnerability with a CVSS score of 8.1 (HIGH). Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyo...
How severe is CVE-2026-114087?
CVE-2026-114087 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114087?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.