A critical authentication bypass in the Nango runner tRPC server allows unauthenticated remote attackers to execute arbitrary JavaScript code on the host system.

The vulnerability exists due to a failure to enforce authentication on the runner tRPC server, specifically within the start procedure. An unauthenticated attacker with network access to the runner port can bypass the RUNNER_SECRET_KEY environment variable to trigger arbitrary code execution within the runner process.

The ability for an unauthenticated attacker to achieve remote code execution represents a critical risk to organizational infrastructure. Successful exploitation could lead to full system compromise, unauthorized access to sensitive data integrations managed by Nango, and potential lateral movement within the network. With a CVSS score of 8.1, this vulnerability is classified as high severity, reflecting the significant potential for impact on confidentiality, integrity, and availability.

Immediate Action: Update Nango to version 0.71.6 or later immediately to apply the necessary authentication enforcement patches.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the Nango runner port, specifically looking for attempts to access the start procedure or unexpected tRPC traffic.

Compensating Controls: Restrict network access to the Nango runner port via firewall rules or network segmentation, ensuring only authorized internal services can communicate with the runner.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a severe threat to any environment utilizing Nango. Administrators must prioritize the deployment of version 0.71.6 across all affected instances to remediate the authentication failure. Until the update is applied, network-level access controls should be strictly enforced to mitigate the risk of exploitation by unauthorized remote actors.