Beveiligingsadvies

CVE-2026-9317

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-09-04 17:56:20

Laatst bijgewerkt 2026-09-08 17:45:11

Toegewezen door VulnCheck

CVSS-score 9.2

Status PUBLISHED

Beschrijving

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.

← Alle CVE's bekijken Bekijk op cve.org ↗