CVE-2026-9317: Missing Authentication for Critical Function in NangoHQ nango

CVE-2026-9317 describes a missing authentication vulnerability in NangoHQ's nango product prior to version 0.71.6. The vulnerability exists in the runner tRPC server where the start procedure is exposed without proper authentication enforcement. Attackers who can access the runner port can invoke this procedure without credentials, bypassing the RUNNER_SECRET_KEY environment variable, resulting in remote code execution within the runner process. The CVSS 4.0 score is 9.2, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with network access to the runner port can execute arbitrary JavaScript code remotely without authentication. This compromises the confidentiality, integrity, and availability of the affected system by allowing full control over the runner process.

A fixed version 0.71.6 or later should be applied to remediate this vulnerability. Since the affected versions are prior to 0.71.6, upgrading to 0.71.6 or newer will address the missing authentication issue. No vendor advisory content was provided to indicate otherwise. Patch status is confirmed by the versioning information.