CVE-2026-114087

Versions of Trigger.dev prior to 4.5.6 are vulnerable to an authentication bypass in self-hosted Docker Compose deployments. The root cause is the use of hardcoded default secrets from hosting/docker/.env.example, specifically a hardcoded MAGIC_LINK_SECRET . This flaw allows unauthenticated attac...

EUVD-2026-106890

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGICLINKSECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then...