Quick answers
- Is CVE-2026-9317 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9317 being exploited in the wild.
- How severe is CVE-2026-9317?
- High severity, with a CVSS score of 8.1, published 4 September 2026.
- Which products and versions are affected?
- Nango before 0.71.6.
- Is there a fix for CVE-2026-9317?
- A patch was published on 2026-09-01: Fix committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9317 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-9317?
- Check whether you run Nango at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The runner tRPC server fails to enforce authentication on the `start` procedure, relying on an unenforced RUNNER_SECRET_KEY environment variable for protection. Attackers with network access to the runner port can invoke the exposed start, abort, and notifyWhenIdle procedures without credentials, bypassing authentication entirely. The vulnerability allows remote code execution (RCE) by submitting arbitrary JavaScript code for execution within the runner process. The fix (commit ed3030a, merged 2026-09-01) implements EdDSA JWT-based authentication: jobs mints an Ed25519 JWT with audience `runner`, which runners verify against a public key injected at startup. The NANGO_INTERNAL_AUTH_REQUIRED flag gates enforcement; existing deployments remain unprotected (fail-open) until explicitly enabled.
Affected products
- Nango Nango before 0.71.6
Timeline
- 2026-09-04: disclosed
- 2026-09-01: patched: Fix committed to master branch