External risk intelligence

Nango Runner tRPC Server Missing Authentication Allows Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-9317

The vulnerability exists in a runner tRPC server. While network-reachable, this component is typically an internal backend service used for processing rather than a primary internet-facing web interface or gateway. Public exposure would be an atypical configuration, making reachability from the internet possible in some deployments but not a standard or intended design pattern.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a flaw in a backend component that could allow unauthorized code execution. The main concern is confirming if this specific component is exposed externally and therefore relevant to our environment.

Unauthenticated attackers may run arbitrary code.
Verify if this backend component is exposed.
Assess your specific exposure and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker with network access to the Nango runner port can exploit a missing authentication vulnerability. By sending unauthenticated requests to the `start` procedure within the runner's tRPC server, attackers can bypass the intended secret key protection. This allows them to execute arbitrary JavaScript code remotely.

Network access to the runner port is required.
Invoking the exposed `start` procedure triggers the vulnerability.
Risk of arbitrary JavaScript code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to the runner port to execute arbitrary JavaScript code within the runner process. This could occur when the exposed start procedure is invoked without proper authentication, bypassing security checks.

Runner process code execution.
Invoking the exposed start procedure.
Compromised runner process.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Nango runner tRPC server's missing authentication vulnerability requires immediate attention from teams managing Nango deployments. The first step is to locate all instances of the affected technology, verify network exposure, and identify the accountable system owner. Subsequently, a risk-based remediation plan, prioritizing business-critical and accessible systems, should be established.

Identify Nango runner owners.
Confirm runner network reachability.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Nango?

Nango is an integration platform designed to help developers manage and sync data across various third-party APIs. It provides tools to simplify the complexities of authentication and data transformation. The component affected by this issue is the runner, a backend service responsible for executing integration tasks and processing data workflows within a Nango deployment.

How does CVE-2026-9317 cause a security weakness?

This vulnerability is classified as a Missing Authentication flaw (CWE-306). In affected versions, the runner's tRPC server fails to verify identity for the 'start' procedure. Because this check is absent, the system does not require the expected security credentials. Consequently, an unauthorized user can interact with the runner and command it to execute arbitrary JavaScript code.

What specifically triggers this remote code execution?

The vulnerability is triggered when an attacker successfully sends a request to the 'start' procedure on the runner tRPC server. For this to occur, the attacker must have network reachability to the runner port. Notably, simply having the software installed is not enough; the attacker must be able to reach that specific network endpoint. If the runner port is firewalled or restricted to local-only traffic, the attack path is effectively blocked.

Is my Nango deployment at risk from the internet?

According to Halo Surface Signal, this vulnerability affects an internal backend service, not a typical public-facing web gateway. While it is possible to configure the runner to be reachable from the internet, doing so is not standard design. You should prioritize checking if your runner port is accessible beyond your private network, as internal-only services are generally less accessible to remote attackers.

What should I do if I use Nango?

Your first step is to confirm which versions of Nango are currently running in your environment. If you are using any version prior to 0.71.6, you should identify the system owners and evaluate the network exposure of your runner instances. Once identified, plan to update to version 0.71.6 or later, which addresses the missing authentication. Prioritize systems that may have accidental or unnecessary network visibility.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.