Trigger.dev before version 4.6.0 contains an improper authorization flaw in the GET /api/v1/projects/:projectRef/envvars endpoint. The endpoint exposes the environment’s root API key as the TRIGGER_SECRET_KEY parameter for staging, production, and preview environments, thereby revealing secret credentials. An attacker who possesses a key with read:envvars privileges can obtain the root secret and all plaintext secrets, enabling them to trigger tasks and mint administrative public JWTs, which effectively allows full control over the application’s operational state. The vulnerability is categorized as CWE‑269, improper privilege management.

The affected product is Trigger.dev, provided by the vendor triggerdotdev. All installations of Trigger.dev using versions older than 4.6.0 are potentially impacted, regardless of the environment (staging, production, or preview). No CPE string is supplied in the data.

The CVSS score of 8.6 indicates high severity, while the EPSS score of <1% shows that exploitation is considered very unlikely at present but not impossible. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network request to the exposed GET endpoint; this inference is based on the fact that the vulnerability is accessed through an API call. An attacker needs only a restricted read:envvars key to exploit the flaw, and no higher privileges are required.