CVE-2026-9317

Nango before 0.71.6 exposes a tRPC server on its runner component that fails to authenticate incoming requests (CWE-306), meaning the RUNNER_SECRET_KEY environment variable is defined but never enforced. An attacker with network access to the runner port can invoke the exposed 'start' procedure without any credentials, causing arbitrary JavaScript code to execute within the runner process and yielding full remote code execution with high impact to confidentiality, integrity, and availability on the runner (CVSS 4.0: 9.2, critical). Affected users are operators of self-hosted Nango deployments running versions prior to 0.71.6 where the runner port is reachable from an untrusted network. No public proof-of-concept, listing in CISA KEV, or confirmed exploitation is known; EPSS currently assigns only a 0.7% probability of exploitation within 30 days.

What to do: Upgrade self-hosted Nango to version 0.71.6 or later. As an interim mitigation, restrict network access to the runner port so only trusted internal services can reach it; note that setting RUNNER_SECRET_KEY does not help on affected versions because it is not enforced. Audit your environment for runner ports reachable from untrusted networks or the internet.