vulnerability · Fri 02 Oct 2026 · 22:39 UTC
GHSA-gg6r-gp4c-89hp: Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Filed UTCSource GTH ↗
TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coordinator-secret") baked into source. The override variable isn't documented in the self-host docs, .env.example, or helm values, so any operator who didn't read source ships with the default. Once connected, READY_FOR_EXECUTION returns the run's decrypted env vars. Anyone who can reach a default-config self-hosted webapp can pull production secrets out of any run whose internal id they can find. …
Signals
as the pipeline stamped them- High
- Critical vulnerability
- What to do
- Critical severity — schedule an urgent patch.
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.