Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA nango (NangoHQ) Fixed in 0.71.6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9317
- 2026-10-03 Alias added: GHSA-9cph-w8mv-q56r
References
Patch 2
Other 1
More NangoHQ vulnerabilities
- TI-2026-62543 Nango through 0.70.4 Server-Side Request Forgery via Configuration CVSS 4.0HIGH 7.1
- TI-2026-71347 Missing RBAC check on Nango flow-read routes exposes production flows CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-9317 · CVE Program
- CVE-2026-9317 · NVD
- FIRST EPSS
- GHSA-9cph-w8mv-q56r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences