CVE-2026-9317

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Published Sep 4, 2026 CVSS 4.0 · 9.2 Critical EPSS 1.3% KEV · Not listed

Description

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Analysis

Technical impact

A flaw in Nango versions prior to 0.71.6 allows an attacker to invoke the exposed start procedure on the runner tRPC server without authentication, enabling the execution of arbitrary JavaScript code within the runner process. The vulnerability bypasses the RUNNER_SECRET_KEY check, meaning that no credentials are required to trigger code execution.

Affected Systems

The affected product is Nango, distributed by NangoHQ. All releases before version 0.71.6 are vulnerable; upgrading to 0.71.6 or later removes the flaw.

Risk and Exploitability

The CVSS score of 9.2 classifies this as Critical. Although the EPSS score is not provided, the lack of authentication and the ability to execute code remotely make exploitation highly likely if the runner port is reachable from the network. This CVE is not listed in the CISA KEV catalog, but the vulnerability itself remains exploitable until patched. Attackers can compromise the runner environment, potentially affecting any services or data that the runner can access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NangoHQ

nango

unaffected

Version	Status	Constraints
`0`	affected	< 0.71.6

No data.

Vendor Product Versions

Nangohq

Nango

Version	Status	Scheme	Platform
`[0,0.71.6)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Nango to version 0.71.6 or later to remove the missing authentication bug.
Restrict network access to the runner tRPC port using firewall rules to ensure only trusted hosts can reach it.
Require and verify the RUNNER_SECRET_KEY environment variable for all runner instances, treating it as a mandatory credential.
Enable logging of runner start attempts and review logs regularly for signs of unauthorized activity.

Generated by OpenCVE AI on September 4, 2026 at 20:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.3% (1.264% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2
https://github.com/NangoHQ/nango/pull/7288
https://github.com/NangoHQ/nango/releases/tag/v0.71.6
https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server

History

Sep 8, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 7, 2026 8:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nangohq Nangohq nango
Vendors & Products		Nangohq Nangohq nango

Sep 4, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
Title		Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Weaknesses		CWE-306
References		https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2 https://github.com/NangoHQ/nango/pull/7288 https://github.com/NangoHQ/nango/releases/tag/v0.71.6 https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`