EUVD-2026-71631
GHSA-9cph-w8mv-q56r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable RCE via an unprotected execution procedure gives PR:N/UI:N and full C/I/A impact within the runner; runner-port reachability is a deployment precondition, not added AC.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
AnalysisAI
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the runner process by invoking the runner tRPC server's exposed 'start' procedure. The runner fails to enforce the RUNNER_SECRET_KEY environment variable, so any actor with network reach to the runner port can trigger code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the Nango runner's tRPC server port on a Nango deployment older than v0.71.6; no authentication, credentials, or user interaction are needed because the 'start' procedure is exposed and RUNNER_SECRET_KEY is not enforced. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 and reflects unauthenticated, network-reachable, high-impact RCE, with AT:P signaling a deployment precondition - the runner port must be network-accessible to the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Nango v0.71.6 or later (https://github.com/NangoHQ/nango/releases/tag/v0.71.6), which enforces authentication on the runner tRPC procedures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Nango and verify current deployment versions across development, staging, and production environments; restrict network access to the Nango runner port to trusted internal IPs only if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today