CVE-2026-9317Patch

LOWCVSS 9.2 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-09-04); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Patch

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

HOL@HashgraphOnline46d
Patch
Anyone who can reach your self-hosted Nango runner port can make it run their code. Upgrade to 0.71.6 and set NANGO_INTERNAL_AUTH_REQUIRED=true (upgrade alone is not enough). CVE-2026-9317 https://hol.org/blog/cve-2026-9317-nango-runner-trpc-missing-auth-rce https://t.co/aLR8Wxgyqn
Post summary
The post highlights a remote code execution weakness in the self-hosted Nango runner (CVE-2026-9317) and recommends upgrading to 0.71.6 with NANGO_INTERNAL_AUTH_REQUIRED enabled to mitigate.
021911.6K
19.2K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters41d
Patch
CVE-2026-9317: Nango <0.71.6 has a missing auth flaw in its runner tRPC server. Attackers can send requests to the unpatched start procedure, bypassing RUNNER_SECRET_KEY to trigger RCE. CVSS 8.1. Patch or isolate the runner port https://www.valtersit.com/cve/CVE-2026-9317 #valtersit #CVE #CVEAlert #infosec #SysAdmin #cybersecurity #Linux #devsecops #devops #developer #sysadmin #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #ethicalhacking #cybersecurityawareness #cybersecurity #cybersecuritynews #cybersecuritytips #python #hacker #linux #kali #ubuntu #debian #ukraine #spain #ireland #unitedkingdom #canada #finland #estonia #lithuania #ireland #hungary #denmark #norway #malta #mexico #switczerland #china #france #germany #docker #kali
Post summary
CVE‑2026‑9317 exposes a missing authentication flaw in Nango’s runner tRPC server that can lead to remote code execution; an immediate patch or network isolation is recommended.
0000059
1.0K followersView on X

Explore more

Back to dashboard