CVE-2026-9317: Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNERSECRETKEY environment variable, to achieve remote code execution within the runner process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated remote code execution?
Nango deployments before 0.71.6 are exposed if an attacker has network access to the runner port. The affected service is the runner tRPC server.
Does configuring RUNNER_SECRET_KEY prevent exploitation?
No. The vulnerability exists because authentication on the runner start procedure is missing, and the RUNNER_SECRET_KEY environment variable is unenforced.
What access does an attacker need?
An attacker does not need credentials or user interaction. They need network access to the runner port and can invoke the exposed start procedure to execute arbitrary JavaScript within the runner process.
What should be done if an immediate upgrade is not possible?
Restrict network access to the runner port so untrusted attackers cannot reach the runner tRPC server. This is the available mitigation indicated by the requirement for network access to the exposed procedure.