Nango CVE-2026-9317

Exploitation requires network access to the Nango runner's tRPC server port on a Nango deployment older than v0.71.6; no authentication, credentials, or user interaction are needed because the 'start' procedure is exposed and RUNNER_SECRET_KEY is not enforced. The primary limiting factor is reachability of the runner port - in deployments where the runner is bound to localhost or an internal-only network segment, an external attacker cannot reach it, which is the real-world constraint that the CVSS AT:P (attack requirement present) reflects.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and reflects unauthenticated, network-reachable, high-impact RCE, with AT:P signaling a deployment precondition - the runner port must be network-accessible to the attacker. In many deployments the runner is an internal-only service, which materially reduces exposure versus an internet-facing surface, so the realistic risk depends heavily on network segmentation. Publicly available exploit detail exists (VulnCheck advisory), raising near-term risk, but there is no CISA KEV listing and no EPSS score provided, so active mass exploitation is not confirmed. This is a genuine high priority for anyone exposing the runner beyond a trusted network boundary; for well-segmented deployments the practical risk is lower but still warrants prompt patching given the trivial exploitation once the port is reachable.

An attacker who can reach the runner's tRPC port (for example, a service left exposed to a shared network or the internet) sends a crafted request to the unauthenticated 'start' procedure and supplies attacker-controlled JavaScript, which executes in the runner process. Because no credential is required and exploit detail is public via VulnCheck, an attacker on the same network path can achieve RCE with a single request and pivot into connected integration secrets and infrastructure.