Auth bypass in Nangohq Nango
CVE-2026-9317
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.013 · change: +0.006
Affected products
Weakness classification (CWE)
References
- github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2 (patch)
- github.com/NangoHQ/nango/pull/7288 (issue-tracking, patch)
- github.com/NangoHQ/nango/releases/tag/v0.71.6 (release-notes)
- www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-s… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-9317?
- CVE-2026-9317 is a high-severity vulnerability in Nangohq Nango, classified under Missing Authentication for Critical Function. CVSS score: 8.1/10. Published 2026-09-04.
- How severe is CVE-2026-9317?
- High severity. CVSS v3 base score is 8.1 out of 10.