{"id":"CVE-2026-9317","summary":"Nango \u003c 0.71.6 Missing Authentication RCE via runner tRPC server","details":"Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.","modified":"2026-09-06T03:47:07.357523871Z","published":"2026-09-04T17:56:20.208Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9317.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9317.json"},{"type":"ADVISORY","url":"https://github.com/NangoHQ/nango/releases/tag/v0.71.6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9317"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server"},{"type":"FIX","url":"https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2"},{"type":"FIX","url":"https://github.com/NangoHQ/nango/pull/7288"},{"type":"PACKAGE","url":"https://github.com/NangoHQ/nango"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nangohq/nango","events":[{"introduced":"0"},{"fixed":"212261465906aa9a0963f1cefc6b60282750a176"},{"fixed":"ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.71.6"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["managed-1.6.7-0.71.5-b14e3aa3e113fd0996a2484e6ba7befe3261ecc1","v0.71.5","managed-1.6.6-0.71.4-3b2c0410e3b8444d5eacb45817f74ee8d462711a","managed-1.6.5-0.71.4-b6a11be5e83e48fc2f4758685ce2d6a12d817fad","v0.71.4","managed-1.6.4-0.71.3-3d6911d08f7a24b2b34dc70b38c4fc2ff043fbfc","v0.71.3","managed-1.6.3-0.71.2-d9783cb2211312d673184aff9974df9535972863","managed-1.6.2-0.71.2-fad81b1da5b2495db013a2b6cd922049ed57da2c","managed-1.6.1-0.71.2-6c4a526ed4928b2fb815f9933b502722230f50e6","v0.71.2","v0.71.1","managed-1.6.0-0.71.0-b27d0d367c67d1bf61f11a01c5e57fd550778b05","managed-1.5.12-0.70.9-27ea2b528e7df47b99d9250c6880753c81cd1e7d","v0.70.9","managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a","v0.70.8","managed-1.5.10-0.70.7-2c0c2b7d0287b0dce3728b8ff07aa83f124e4b8d","v0.70.7","managed-1.5.9-0.70.6-e81f6c2beee75409b5c78c0f4e55bfc4d643042d","managed-1.5.8-0.70.6-50423dd0f8986fd173d33418340b8d9bd4d2c1f4","managed-1.5.7-0.70.6-fe4a94f3ed76e2386edb41c6b7d8d5de467daf94","v0.70.6","managed-1.5.6-0.70.5-9a9883712fd634fa4b4b5b5d24d8c2ab5c7ef579","managed-1.5.5-0.70.5-a447dd8c75b2412d88862ceb02c298c3228b635b","v0.70.5","managed-1.5.4-0.70.4-0fe07a6d83aea0becc4cea382c5cead2f555718d","v0.70.4","managed-1.5.3-0.70.3-8ad36940476ad129a6450dd152636498d4d2285f","v0.70.3","v0.70.2","managed-1.5.2-0.70.1-fd331f09bfdff10d6fb7c1c292c9a56fbebf44ef","managed-1.5.1-0.70.1-5e931ac80c6e6adbf14149249f00c4d068fd0a64","v0.70.1","managed-1.5.0-0.70.0-2724cf5b6dab04a7040919dc1e693ff08c84d4e3","v0.70.0","v0.69.50","v0.69.49","managed-1.4.15-0.69.48-7bdd3e5684ad84dc74922c40c516528c7ff33ae4","v0.69.48","v0.69.47","v0.69.46","managed-1.4.14-0.69.46-e4b7a312a5f20fd23a1932c0e5e41f9ae8fe0ec7","v0.69.45","v0.69.44","v0.69.43","v0.69.42","v0.69.41","v0.69.40","v0.69.39","managed-1.4.13-0.69.38-ab8b203d6316643fd1e3e7aafce567d2b29a988e","managed-1.4.12-0.69.38-55b35c6a10aa6d08ec4fd16532cf30125dee7977","v0.69.38","v0.69.36","v0.69.35","v0.69.34","v0.69.33","v0.69.32","managed-1.4.11-0.69.31-8b281d6cc88e062f01f8d10040b4bda928443ae4","v0.69.31","v0.69.30","v0.69.29","v0.69.28","v0.69.27","managed-1.4.10-0.69.26-f6621ee4cae9d1cdd7ed4c4c73bbbe9ef7c7a7b1","v0.69.26","managed-1.4.9-0.69.22-4fc73b2775cc1e5554d03de5c5320ba651d8e478","managed-1.4.8-0.69.22-da96e83743a3e9d7165d09f7901dd58b52dbfbbf","v0.69.22","managed-1.4.7-0.69.21-089856699158d3d8466bf938aed2f8eb93a0c2a3","v0.69.21","v0.69.20","v0.69.19","v0.69.18","v0.69.17","v0.69.16","v0.69.15","v0.69.14","v0.69.13","v0.69.12","v0.69.10","v0.69.9","v0.69.8","v0.69.7","v0.69.6","v0.69.5","v0.69.4","v0.69.3","v0.69.2","v0.69.1","v0.69.0","v0.68.0","v0.67.8","v0.67.7","v0.67.6","v0.67.5","v0.67.4","v0.67.3","v0.67.2","v0.67.1","v0.67.0","v0.66.2","v0.66.1","v0.66.0","v0.65.0","v0.64.4","v0.64.3","v0.64.2","v0.64.1","v0.64.0","v0.63.1","v0.63.0","v0.62.1","v0.62.0","v0.61.3","v0.61.2","v0.61.1","v0.61.0","v0.60.5","v0.60.4","v0.60.3","v0.60.2","v0.60.1","v0.60.0","v0.59.13","v0.59.12","v0.59.11","v0.59.8","v0.59.7","v0.59.3","v0.59.1","v0.59.0","v0.58.7","v0.58.6","v0.58.5","v0.58.4","v0.58.3","v0.58.2","v0.58.1","v0.57.6","v0.57.5","v0.57.4","v0.57.3","v0.57.2","v0.57.1","v0.57.0","v0.56.4","v0.56.3","v0.56.2","v0.56.1","v0.56.0","v0.55.0","v0.54.0","v0.53.2","v0.53.1","v0.53.0","v0.52.5","v0.52.4","v0.52.3","v0.52.2","v0.52.1","v0.51.0","v0.50.0","v0.49.0","v0.48.4","v0.48.3","v0.48.2","v0.48.1","v0.48.0","v0.47.1","v0.47.0","v0.46.1","v0.46.0","v0.45.1","v0.45.0","v0.44.0","v0.43.0","v0.42.22","v0.42.21","v0.42.20","v0.42.19","v0.42.18","v0.42.17","v0.42.15","v0.42.12","v0.42.10","v0.42.9","v0.42.8","v0.42.7","v0.42.6","v0.42.5","v0.42.4","v0.42.2","v0.42.0","v0.41.1","v0.41.0","v0.40.10","v0.40.9","v0.40.8","v0.40.7","v0.40.6","v0.40.5","v0.40.4","v0.40.3","v0.40.2","v0.40.1","v0.40.0","v0.39.33","v0.39.32","v0.39.31","v0.39.30","v0.39.29","v0.39.28","v0.39.27","v0.39.26","v0.39.25","v0.39.24","v0.39.23","v0.39.22","v0.39.21","v0.39.20","v0.39.19","v0.39.18","v0.39.17","v0.39.16","v0.39.15","v0.39.14","v0.39.13","v0.37.0","v0.39.8","v0.39.7","v0.39.6","v0.39.5","v0.39.4","v0.39.3","v0.39.2","v0.39.1","v0.39.0","v0.38.5","v0.38.4","v0.38.3","v0.38.1","v0.38.0","v0.37.26","v0.37.25","v0.37.24","v0.37.23","v0.37.22","v0.37.21","v0.37.20","v0.37.19","v0.37.18","v0.37.17","v0.37.16","v0.37.15","v0.37.14","v0.37.13","v0.37.12","v0.37.11","v0.37.10","v0.37.9","v0.37.8","v0.37.7","v0.37.6","v0.37.5","v0.37.4","v0.37.3","v0.37.2","v0.37.1","v0.36.14","v0.35.5","v0.33.0","v0.32.8","v0.31.5","v0.29.0","v0.28.1","v0.27.0","v0.26.1","v0.25.6","0.25.6","v0.24.5","v0.24.4","v0.16.0","v0.15.1","v0.14.0","v0.13.5","v0.13.4","0.13.0","v0.12.7","v0.12.6","v0.12.4","v0.12.3","v0.12.1","v0.11.3","v0.11.2","v0.10.7","v0.10.4","v0.10.2","v0.10.1","v0.9.4","v0.9.0","v0.8.8","v0.8.7","v0.8.6","v0.8.5","v0.8.0","v0.7.2","v0.7","v0.5.2","v0.5.1","v0.5.0","v0.4.0","v0.3.7","v0.3.6","v0.2.2","v0.2.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9317.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}