Vulnerability details

CVE-2026-9317

NangoHQ nango

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

CVSS 4.0

9.2Critical

Official description

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
NangoHQ	nango	v < 0.71.6	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/NangoHQ/nango/releases/tag/v0.71.6 release-notes
https://github.com/NangoHQ/nango/pull/7288 issue-trackingpatch
https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2 patch
https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-04
Last updated: 2026-09-08
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

1.26%

Probability of exploitation in 30 days

69.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-306
Missing Authentication for Critical Function