GHSA-gg6r-gp4c-89hp
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coordinator-secret") baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the default. Once connected, READY_FOR_EXECUTION returns the run's decrypted env vars.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- Affected packages
- trigger.dev (npm) < 4.5.4, fixed in 4.5.4 · GHSA-gg6r-gp4c-89hp