Nango - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/nango/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 19:26:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in Nango Runner tRPC Serverhttps://feed.craftedsignal.io/briefs/2026-09-nango-auth-bypass/Fri, 04 Sep 2026 19:26:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-nango-auth-bypass/Nango versions prior to 0.71.6 contain an authentication bypass vulnerability allowing unauthenticated attackers to achieve remote code execution via the tRPC runner server.Nango versions prior to 0.71.6 are vulnerable to an authentication bypass in the runner tRPC server. An unauthenticated attacker with network access to the runner service can invoke the exposed 'start' procedure without providing the required RUNNER_SECRET_KEY. This flaw allows the execution of arbitrary JavaScript code within the context of the runner process, leading to remote code execution (RCE). The vulnerability stems from a failure to enforce authentication controls on specific internal tRPC procedures, making it a critical risk for deployments where the runner is reachable by untrusted network entities. Defenders must upgrade to version 0.71.6 or later to enforce proper credential validation.

Attack Chain

  1. Attacker performs network reconnaissance to identify reachable runner ports associated with Nango deployments.
  2. Attacker establishes a network connection to the target tRPC runner server port.
  3. Attacker crafts a malicious tRPC request targeting the 'start' procedure.
  4. Attacker omits or provides an invalid RUNNER_SECRET_KEY in the request payload.
  5. The Nango runner server fails to validate the request, incorrectly assuming authorization.
  6. The 'start' procedure processes the request and executes the embedded malicious JavaScript code.
  7. Attacker achieves remote code execution within the runner process context.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript code on the Nango runner service. This can lead to full system compromise, unauthorized data access, and potential lateral movement within the network infrastructure where the runner is hosted.

Recommendation

  1. Upgrade Nango to version 0.71.6 or later immediately to patch CVE-2026-9317.
  2. Restrict network access to the Nango runner tRPC server port to authorized management subnets only.
  3. Implement egress filtering and monitoring to detect suspicious network activity originating from the Nango runner process.
]]>highadvisoryvulnerabilityremote-code-executionnango