Dashboard / CVE-2026-114073

CVE-2026-114073

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 39/100
Published: 2026-10-21 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: High
VI: None
VA: None

Description

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debug logs, or support bundles can read the Starting buildWorker record to recover database connection strings and service credentials.

Weakness Classification (1)

References & Advisories (2)

Bug Bounty Relevance

39 / 100
✓ No authentication
✓ Low complexity

CVSS Score

6.8 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.23%
Raw Score 0.002280
Percentile 13.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00228
2026-10-28
0.00228

Intelligence Sources

mitre ref →
nvd ref →

External Links