{"vulnerability": "CVE-2026-9317", "sightings": [{"uuid": "aaba095f-2363-4b0b-b537-b8461b7c1222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hmahqdrfdyv4b", "content": "CVE-2026-9317 - Nango\nCVE ID : CVE-2026-9317\n \n Published : Sept. 4, 2026, 6:18 p.m. | 19\u00a0minutes ago\n \n Description : Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaS...", "creation_timestamp": "2026-09-04T19:04:51.799983Z"}, {"uuid": "a0864715-2d0e-44d6-b75f-79ff72bf26df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mupp7ul4sb2w", "content": "CVE-2026-9317 - nango\nThe Nango service version earlier than 0.71.6 does not check who can start its runner component. Anyone who can reach the runner\u2019s network port can tell it to start and run any JavaScript\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nango #nangohq #CVE #infosec", "creation_timestamp": "2026-09-04T19:30:06.182303Z"}, {"uuid": "b040281e-0753-41ff-996a-4a6669b57c91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mupqy7uxmd2l", "content": "\ud83d\udfe0 CVE-2026-9317 - High (8.1)\n\nNango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server tha...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-9317/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-04T20:01:37.916431Z"}, {"uuid": "efdfb4b5-a716-4877-b611-b3784db23e76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muprehmnuv2y", "content": "\ud83d\udea8 CVE-2026-9317 \u2014 CVSS 9.2 CRITICAL\n\nNango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows u...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-9317\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-04T20:08:27.682226Z"}, {"uuid": "15723a6c-04dc-4abf-a0c8-73ff8551ae07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv4h5ayftb2v", "content": "CVE-2026-9317: Nango <0.71.6 has a missing auth flaw in its runner tRPC server. Attackers can send requests to the unpatched start procedure, bypassing RUNNER_SECRET_KEY to trigger RCE. CVSS 8.1. Patch or isolate the runner port immediately. https://www.valtersit.com/cve/CVE-2026", "creation_timestamp": "2026-09-09T21:10:05.355623Z"}, {"uuid": "13d04c4f-2913-4a97-8233-b42bb3b6babe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9317", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117243130997619084", "content": "CVE-2026-9317: Nango <0.71.6 has a missing auth flaw in its runner tRPC server. Attackers can send requests to the unpatched start procedure, bypassing RUNNER_SECRET_KEY to trigger RCE. CVSS 8.1. Patch or isolate the runner port immediately. https://www.valtersit.com/cve/CVE-2026", "creation_timestamp": "2026-09-09T21:10:10.880070Z"}]}