CVE-2026-9317

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9317

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9317.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9317

Published

2026-09-04T17:56:20.208Z

Modified

2026-09-06T03:47:07.357523871Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Details

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNERSECRETKEY environment variable, to achieve remote code execution within the runner process.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9317.json",
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/nangohq/nango

Affected ranges

Type

GIT

Repo

https://github.com/nangohq/nango

Events

Introduced

Fixed

212261465906aa9a0963f1cefc6b60282750a176

Fixed

ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.71.6"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.13.0

0.25.6

managed-1.*

managed-1.4.10-0.69.26-f6621ee4cae9d1cdd7ed4c4c73bbbe9ef7c7a7b1

managed-1.4.11-0.69.31-8b281d6cc88e062f01f8d10040b4bda928443ae4

managed-1.4.12-0.69.38-55b35c6a10aa6d08ec4fd16532cf30125dee7977

managed-1.4.13-0.69.38-ab8b203d6316643fd1e3e7aafce567d2b29a988e

managed-1.4.14-0.69.46-e4b7a312a5f20fd23a1932c0e5e41f9ae8fe0ec7

managed-1.4.15-0.69.48-7bdd3e5684ad84dc74922c40c516528c7ff33ae4

managed-1.4.7-0.69.21-089856699158d3d8466bf938aed2f8eb93a0c2a3

managed-1.4.8-0.69.22-da96e83743a3e9d7165d09f7901dd58b52dbfbbf

managed-1.4.9-0.69.22-4fc73b2775cc1e5554d03de5c5320ba651d8e478

managed-1.5.0-0.70.0-2724cf5b6dab04a7040919dc1e693ff08c84d4e3

managed-1.5.1-0.70.1-5e931ac80c6e6adbf14149249f00c4d068fd0a64

managed-1.5.10-0.70.7-2c0c2b7d0287b0dce3728b8ff07aa83f124e4b8d

managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a

managed-1.5.12-0.70.9-27ea2b528e7df47b99d9250c6880753c81cd1e7d

managed-1.5.2-0.70.1-fd331f09bfdff10d6fb7c1c292c9a56fbebf44ef

managed-1.5.3-0.70.3-8ad36940476ad129a6450dd152636498d4d2285f

managed-1.5.4-0.70.4-0fe07a6d83aea0becc4cea382c5cead2f555718d

managed-1.5.5-0.70.5-a447dd8c75b2412d88862ceb02c298c3228b635b

managed-1.5.6-0.70.5-9a9883712fd634fa4b4b5b5d24d8c2ab5c7ef579

managed-1.5.7-0.70.6-fe4a94f3ed76e2386edb41c6b7d8d5de467daf94

managed-1.5.8-0.70.6-50423dd0f8986fd173d33418340b8d9bd4d2c1f4

managed-1.5.9-0.70.6-e81f6c2beee75409b5c78c0f4e55bfc4d643042d

managed-1.6.0-0.71.0-b27d0d367c67d1bf61f11a01c5e57fd550778b05

managed-1.6.1-0.71.2-6c4a526ed4928b2fb815f9933b502722230f50e6

managed-1.6.2-0.71.2-fad81b1da5b2495db013a2b6cd922049ed57da2c

managed-1.6.3-0.71.2-d9783cb2211312d673184aff9974df9535972863

managed-1.6.4-0.71.3-3d6911d08f7a24b2b34dc70b38c4fc2ff043fbfc

managed-1.6.5-0.71.4-b6a11be5e83e48fc2f4758685ce2d6a12d817fad

managed-1.6.6-0.71.4-3b2c0410e3b8444d5eacb45817f74ee8d462711a

managed-1.6.7-0.71.5-b14e3aa3e113fd0996a2484e6ba7befe3261ecc1

v0.*

v0.10.1

v0.10.2

v0.10.4

v0.10.7

v0.11.2

v0.11.3

v0.12.1

v0.12.3

v0.12.4

v0.12.6

v0.12.7

v0.13.4

v0.13.5

v0.14.0

v0.15.1

v0.16.0

v0.2.1

v0.2.2

v0.24.4

v0.24.5

v0.25.6

v0.26.1

v0.27.0

v0.28.1

v0.29.0

v0.3.6

v0.3.7

v0.31.5

v0.32.8

v0.33.0

v0.35.5

v0.36.14

v0.37.0

v0.37.1

v0.37.10

v0.37.11

v0.37.12

v0.37.13

v0.37.14

v0.37.15

v0.37.16

v0.37.17

v0.37.18

v0.37.19

v0.37.2

v0.37.20

v0.37.21

v0.37.22

v0.37.23

v0.37.24

v0.37.25

v0.37.26

v0.37.3

v0.37.4

v0.37.5

v0.37.6

v0.37.7

v0.37.8

v0.37.9

v0.38.0

v0.38.1

v0.38.3

v0.38.4

v0.38.5

v0.39.0

v0.39.1

v0.39.13

v0.39.14

v0.39.15

v0.39.16

v0.39.17

v0.39.18

v0.39.19

v0.39.2

v0.39.20

v0.39.21

v0.39.22

v0.39.23

v0.39.24

v0.39.25

v0.39.26

v0.39.27

v0.39.28

v0.39.29

v0.39.3

v0.39.30

v0.39.31

v0.39.32

v0.39.33

v0.39.4

v0.39.5

v0.39.6

v0.39.7

v0.39.8

v0.4.0

v0.40.0

v0.40.1

v0.40.10

v0.40.2

v0.40.3

v0.40.4

v0.40.5

v0.40.6

v0.40.7

v0.40.8

v0.40.9

v0.41.0

v0.41.1

v0.42.0

v0.42.10

v0.42.12

v0.42.15

v0.42.17

v0.42.18

v0.42.19

v0.42.2

v0.42.20

v0.42.21

v0.42.22

v0.42.4

v0.42.5

v0.42.6

v0.42.7

v0.42.8

v0.42.9

v0.43.0

v0.44.0

v0.45.0

v0.45.1

v0.46.0

v0.46.1

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.48.3

v0.48.4

v0.49.0

v0.5.0

v0.5.1

v0.5.2

v0.50.0

v0.51.0

v0.52.1

v0.52.2

v0.52.3

v0.52.4

v0.52.5

v0.53.0

v0.53.1

v0.53.2

v0.54.0

v0.55.0

v0.56.0

v0.56.1

v0.56.2

v0.56.3

v0.56.4

v0.57.0

v0.57.1

v0.57.2

v0.57.3

v0.57.4

v0.57.5

v0.57.6

v0.58.1

v0.58.2

v0.58.3

v0.58.4

v0.58.5

v0.58.6

v0.58.7

v0.59.0

v0.59.1

v0.59.11

v0.59.12

v0.59.13

v0.59.3

v0.59.7

v0.59.8

v0.60.0

v0.60.1

v0.60.2

v0.60.3

v0.60.4

v0.60.5

v0.61.0

v0.61.1

v0.61.2

v0.61.3

v0.62.0

v0.62.1

v0.63.0

v0.63.1

v0.64.0

v0.64.1

v0.64.2

v0.64.3

v0.64.4

v0.65.0

v0.66.0

v0.66.1

v0.66.2

v0.67.0

v0.67.1

v0.67.2

v0.67.3

v0.67.4

v0.67.5

v0.67.6

v0.67.7

v0.67.8

v0.68.0

v0.69.0

v0.69.1

v0.69.10

v0.69.12

v0.69.13

v0.69.14

v0.69.15

v0.69.16

v0.69.17

v0.69.18

v0.69.19

v0.69.2

v0.69.20

v0.69.21

v0.69.22

v0.69.26

v0.69.27

v0.69.28

v0.69.29

v0.69.3

v0.69.30

v0.69.31

v0.69.32

v0.69.33

v0.69.34

v0.69.35

v0.69.36

v0.69.38

v0.69.39

v0.69.4

v0.69.40

v0.69.41

v0.69.42

v0.69.43

v0.69.44

v0.69.45

v0.69.46

v0.69.47

v0.69.48

v0.69.49

v0.69.5

v0.69.50

v0.69.6

v0.69.7

v0.69.8

v0.69.9

v0.7

v0.7.2

v0.70.0

v0.70.1

v0.70.2

v0.70.3

v0.70.4

v0.70.5

v0.70.6

v0.70.7

v0.70.8

v0.70.9

v0.71.1

v0.71.2

v0.71.3

v0.71.4

v0.71.5

v0.8.0

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.9.0

v0.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9317.json"