CVE-2026-9317CWE-306

CVE-2026-9317

High · published September 4, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01264 · 69.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-04T22:18Z
References (4)
https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2 · [email protected]https://github.com/NangoHQ/nango/pull/7288 · [email protected]https://github.com/NangoHQ/nango/releases/tag/v0.71.6 · [email protected]https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server · [email protected]
EPSS history
Timeline
  • 06 SEP 03:34Z
    EPSS moved — → 1%
    epss
  • 04 SEP 17:56Z
    Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
    cvelistv5