Description

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-04T18:18:07.297Z",
  "pubdate": "2026-09-04T18:18:07.297Z",
  "executiveSummary": "A critical missing authentication vulnerability exists in the Nango runner tRPC server in versions prior to 0.71.6. This flaw permits unauthenticated remote attackers to execute arbitrary JavaScript code within the runner process.\nThe vulnerability stems from an insecure implementation of the runner's tRPC server, which fails to enforce the configured RUNNER_SECRET_KEY environment variable for the 'start' procedure.\nBy invoking this procedure, an attacker with network reach to the runner port can bypass authentication controls and achieve remote code execution (RCE).\nThis represents a severe security risk, as successful exploitation grants the attacker the ability to perform operations with the privileges of the runner process, potentially leading to unauthorized data access, system compromise, or lateral movement within the environment.\nNo prior authentication or specific user privileges are required for exploitation, provided the attacker has direct network access to the target port.",
  "technicalDetails": "The root cause of this vulnerability is a failure to properly implement authentication middleware on the tRPC 'start' procedure within the Nango runner server. Although the design intends for the RUNNER_SECRET_KEY environment variable to gate access to sensitive procedures, this mechanism is unenforced for the 'start' endpoint in affected versions.\nThe Nango runner utilizes a tRPC server to handle task orchestration. The 'start' procedure, intended to initiate job execution, is exposed on the runner port without mandatory authentication validation. Because the backend logic fails to verify the presence or correctness of the secret key before executing the handler associated with this procedure, the interface is effectively exposed to any entity capable of communicating with the runner over the network.\nThe exploitation flow is straightforward and does not require complex pre-conditions. An attacker performing reconnaissance can identify the exposed runner port. Upon identifying the tRPC interface, the attacker crafts a malicious request to the 'start' procedure. Because authentication checks are absent, the server processes the payload.\nThe 'start' procedure is designed to facilitate the execution of custom scripts or tasks, which are represented as JavaScript code. By supplying malicious JavaScript code in the request parameters, an attacker triggers the execution of this code within the context of the runner process. Consequently, the attacker achieves arbitrary RCE.\nSince the code executes with the same privileges as the runner process, the impact includes full control over the runner's environment. This can be leveraged to extract credentials used by Nango, access internal network resources, or further compromise infrastructure, depending on the environment's configuration and the permissions assigned to the runner process. The vulnerability affects all deployments using Nango runner versions prior to 0.71.6."
}