2 matches found
CVE-2026-114069
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...
8.6CVSS0.00258EPSS
SaveExploits0References2
EUVD-2026-107020
Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGERSECRETKEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key c...
8.6CVSS5.9AI score0.00258EPSS
SaveExploits0References2
20