by Kastro
Paper/Archive/CVE-2026-9317

CVE-2026-9317

NangoHQ nango — Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

EPSS 1%CVSS 9.2
critical.is priorityof 100
42
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 69.7.697 × 2013.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Affected

ProductAffectedFixed inSource
nango< 0.71.60.71.6CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/NangoHQ/nango/releases/tag/v0.71.6patchgithub.com/NangoHQ/nango/pull/7288patchgithub.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2writeupvulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server