What is CVE-2026-9317?

CVE-2026-9317 is a high-severity vulnerability, classified under Missing Authentication for Critical Function. CVSS score: 8.1/10. Published 2026-09-04.

How severe is CVE-2026-9317?

High severity. CVSS v3 base score is 8.1 out of 10.

CVE-2026-9317

CVE-2026-9317

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

Frequently asked questions

What is CVE-2026-9317?: CVE-2026-9317 is a high-severity vulnerability, classified under Missing Authentication for Critical Function. CVSS score: 8.1/10. Published 2026-09-04.
How severe is CVE-2026-9317?: High severity. CVSS v3 base score is 8.1 out of 10.