Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

CVE-2026-9317 is a critical missing authentication vulnerability in Nango versions before 0.71.6, affecting the runner tRPC server. Unauthenticated attackers with network access to the runner port can invoke the exposed 'start' procedure without credentials. The vulnerability stems from an unenforced RUNNER_SECRET_KEY environment variable, allowing attackers to bypass authentication entirely. Successful exploitation enables remote code execution of arbitrary JavaScript within the runner process. The fix was introduced in Nango v0.71.6 via a commit to the NangoHQ GitHub repository. Organizations running Nango in environments where the runner port is network-accessible are at significant risk. Users should upgrade to v0.71.6 or later immediately to remediate this vulnerability.