CVE-2026-9317

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.71.6

Description The runner tRPC server contains a missing authentication flaw that allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code. This is achieved by invoking the exposed start procedure without credentials, which bypasses the unenforced RUNNER SECRET KEY environment variable, leading to remote code execution within the runner process.

Recommendations Update to version 0.71.6 and set the NANGO INTERNAL AUTH REQUIRED environment variable to true.