Trigger.dev before version 4.5.4 contains a hardcoded default secret in the /coordinator Socket.IO namespace that allows an unauthenticated attacker to connect using the published coordinator‑secret value. Once connected, the attacker can emit events such as READY_FOR_EXECUTION to retrieve decrypted run environment variables, or send events like TASK_RUN_FAILED_TO_RUN to tamper with arbitrary runs, exposing sensitive information and potentially manipulating job execution.

The vulnerability affects the Trigger.dev platform as distributed by triggerdotdev:trigger.dev. Any installation of Trigger.dev prior to version 4.5.4 is susceptible to this flaw.

The CVSS v3 score of 8.3 indicates high severity. The EPSS score is below 1 %, suggesting low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector demands only a Socket.IO connection to the /coordinator namespace, and no authentication is required to use the hardcoded secret. Attackers can thus obtain privileged information or disrupt runs with minimal effort.