CVE-2026-114073 Details

An information disclosure vulnerability has been identified in the Trigger.dev CLI tool, affecting versions prior to 4.5.9. This vulnerability arises from the serialization of unredacted environment variable values in debug deployment logs, which exposes sensitive information such as database connection strings and service credentials. Attackers with access to terminal transcripts, CI debug logs, or support bundles can exploit this vulnerability by reading the 'Starting buildWorker' record, which contains the exposed secret values.

Users are advised to update to Trigger.dev CLI version 4.5.9 or later. Additionally, it is recommended to avoid serializing environment variable values in debug output, log variable names only, or replace the values with a fixed marker. Regression testing should be added for deployment, dry-run, and debug logging, and adjacent debug records should be reviewed for any resolved secrets.