Trigger.dev installations before version 4.5.6 contain a hardcoded magic link secret that allows an attacker to forge valid magic link tokens. This flaw lets unauthenticated users log in as any email address, effectively bypassing authentication controls and allowing full access to tenant data. Once authenticated, the attacker can reach internal services such as Postgres, Redis, and ClickHouse with their default credentials, resulting in compromise of all tenant data.

The vulnerability affects self‑hosted deployments of Trigger.dev using Docker Compose with trigger.dev versions earlier than 4.5.6. All installations that use the default credentials provided in the runner containers (Postgres, Redis, ClickHouse) are at risk.

The CVSS score is 9.2, indicating high severity, while the EPSS score is less than 1 %, suggesting a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface where an attacker can forge a magic link token. After bypassing authentication, the attacker can exploit the internal network to connect to the database and caching services using their bundled default credentials, giving full control over tenant data.