CVE-2026-9317: Nango Runner tRPC Server RCE Vulnerability

CVE-2026-9317 Overview

CVE-2026-9317 is a missing authentication vulnerability [CWE-306] in Nango versions prior to 0.71.6. The flaw affects the runner tRPC server, which exposes a start procedure without enforcing the RUNNER_SECRET_KEY environment variable. Unauthenticated attackers with network access to the runner port can invoke the exposed procedure to execute arbitrary JavaScript code within the runner process. This yields remote code execution (RCE) inside the Nango runner without credentials or user interaction.

Critical Impact
Network-accessible Nango runners before v0.71.6 can be compromised by unauthenticated attackers who invoke the start procedure to run arbitrary JavaScript within the runner process.

Affected Products

Nango versions prior to 0.71.6
Self-hosted Nango deployments exposing the runner tRPC port
Nango runner service component (control plane runner)

Discovery Timeline

2026-09-04 - CVE-2026-9317 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-9317

Vulnerability Analysis

Nango is an open-source product integrations platform. Its architecture separates control plane services (server, jobs, orchestrator) from runner processes that execute user-defined integration scripts. The runner exposes a tRPC server that accepts task lifecycle calls including a start procedure.

Before v0.71.6, the runner did not enforce authentication on the start procedure. The RUNNER_SECRET_KEY variable existed but was not validated on inbound requests. Any client able to reach the runner port could invoke start with an arbitrary payload. Because start loads and executes JavaScript within the runner process, this collapses directly into RCE inside the runner's execution context.

Root Cause

The root cause is a missing authentication check [CWE-306] on the runner tRPC start procedure. The intended RUNNER_SECRET_KEY gate was not applied, so requests were accepted without credentials. The upstream fix introduces a dedicated runner-dispatch credential model: jobs mints an EdDSA (Ed25519) JWT with aud: runner, and the runner verifies it using a public key injected at node start. The signing key never leaves the jobs service, preventing a compromised runner from minting valid dispatch tokens.

Attack Vector

Exploitation requires network reachability to the runner tRPC port. An attacker sends an unauthenticated start request containing attacker-supplied JavaScript. The runner loads and executes the code inside its process, granting the attacker the runner's privileges, environment variables, filesystem access, and outbound network egress. This can expose integration secrets, OAuth tokens, and connected third-party APIs.

text

# Security patch excerpt: docs/llms-full.txt
- Orchestrator and jobs HTTP APIs accept an `Authorization: Bearer` credential except `GET /health`
+ Orchestrator, jobs, and runner HTTP APIs accept an `Authorization: Bearer` credential except `GET /health`

+ - **Runner dispatch JWT**: jobs mints an EdDSA token (`aud: runner`, `task_id` or `node_id`) and
+   sends it as `Authorization: Bearer` on `start`, `abort`, and `notifyWhenIdle`. The Ed25519
+   private key is derived from `NANGO_INTERNAL_AUTH_SIGNING_KEY` and never leaves jobs. A start
+   call without a valid jobs identity is rejected when `REQUIRED=true`.

Source: GitHub commit ed3030a

Detection Methods for CVE-2026-9317

Indicators of Compromise

Unauthenticated inbound requests to the runner tRPC endpoint invoking the start procedure.
Runner processes spawning unexpected child processes, opening reverse shells, or making outbound connections to unknown hosts.
Runner logs showing task executions with no matching orchestrator or jobs task ID.
Unexpected reads of environment variables containing integration secrets or OAuth tokens.

Detection Strategies

Inspect runner access logs for start invocations missing an Authorization: Bearer header once the patched version is deployed.
Baseline outbound network destinations from runner containers and alert on new domains or IP addresses.
Monitor process trees under the runner service for interpreters (sh, bash, node -e) invoked outside normal integration flows.

Monitoring Recommendations

Ingest Nango runner, jobs, and orchestrator logs into a centralized SIEM and correlate start calls with jobs-issued task IDs.
Alert on any runner tRPC port exposure beyond the internal control plane subnet.
Track deployed Nango versions across environments and flag any instance running below 0.71.6.

How to Mitigate CVE-2026-9317

Immediate Actions Required

Upgrade all Nango deployments to version 0.71.6 or later without delay.
Restrict network access to the runner tRPC port so only the jobs service can reach it.
Rotate any integration secrets, OAuth tokens, and API keys that were reachable from exposed runners.
Set NANGO_INTERNAL_AUTH_REQUIRED=true on orchestrator, jobs, and runners after upgrading to enforce fail-closed authentication.

Patch Information

The fix ships in Nango v0.71.6 via Pull Request #7288 and commit ed3030a. The patch adds a runner-dispatch JWT model using Ed25519 signatures. Jobs mints tokens with aud: runner; runners verify with an injected public key. Full details are documented in the VulnCheck advisory.

Workarounds

Place runner processes behind a network policy or firewall that permits traffic only from the jobs service.
Deploy runners in an isolated namespace or VPC with no ingress from user networks or the public internet.
If upgrade is not immediately feasible, take exposed runners offline until the patched version is deployed.

bash

# Post-upgrade configuration to enforce runner authentication
# On jobs service only (never on runners):
export NANGO_INTERNAL_AUTH_SIGNING_KEY="<HMAC-SECRET>"

# On orchestrator, jobs, and runners (fail closed):
export NANGO_INTERNAL_AUTH_REQUIRED=true

# NANGO_INTERNAL_AUTH_RUNNER_PUBLIC_KEY is injected by jobs at node start
# Do NOT set NANGO_INTERNAL_AUTH_SIGNING_KEY on runner instances