Executive brief
Nango is an open-source platform for integrating third-party APIs with applications. The runner component—which executes integration jobs—exposes an unauthenticated tRPC procedure that allows attackers with network access to send arbitrary code execution requests. An attacker can invoke the `start` procedure without credentials to execute malicious JavaScript within the runner process, potentially compromising data or disrupting integration workflows.
Technical details
The runner tRPC server fails to enforce authentication on the `start` procedure, relying on an unenforced RUNNER_SECRET_KEY environment variable for protection. Attackers with network access to the runner port can invoke the exposed start, abort, and notifyWhenIdle procedures without credentials, bypassing authentication entirely. The vulnerability allows remote code execution (RCE) by submitting arbitrary JavaScript code for execution within the runner process. The fix (commit ed3030a, merged 2026-09-01) implements EdDSA JWT-based authentication: jobs mints an Ed25519 JWT with audience `runner`, which runners verify against a public key injected at startup. The NANGO_INTERNAL_AUTH_REQUIRED flag gates enforcement; existing deployments remain unprotected (fail-open) until explicitly enabled.
Affected products
- Nango Nango before 0.71.6
Timeline
- 2026-09-04: disclosed
- 2026-09-01: patched: Fix committed to master branch