Trigger.dev confirms unauthorized access to some organizations’ environment variables
Trigger.dev says an attacker accessed environment variables for a subset of organizations. It says the exploit is blocked and affected account owners have been emailed, but has not published a root cause or organization count. Platform recovery does not revoke exposed third-party credentials.
- Disclosed
- Nov 1, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- A subset of Trigger.dev organizations’ environment variables; the vendor has contacted affected account owners
- Trigger.dev · cloud · credentials
- In the wild
- Yes
- Trigger.dev confirms attacker access to environment variables.
What happened
The disclosure confirms unauthorized access rather than just a theoretical vulnerability. It does not establish that every organization was affected or that every stored value was taken. Neither the short CTO post nor the status entry identifies the entry point, affected release, victim count or exposure interval. No public fixed version is given, and the announcement does not establish an equivalent flaw in self-hosted installations.
The vendor’s resolved status describes its response, not an independent finding that copied secrets have stopped working. Credential rotation and review of connected services remain the account owner’s recovery work.
Crime-scene timeline
Nov 1, 2026
Trigger.dev discloses environment-variable exposure
Nov 1, 22:50 UTC
Status notice marked resolved; exploit blocked and owners contacted
The notice promises further details; it does not publish a root cause, exposure window or affected-organization count.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.