important · RCE — Integration runners
A reachable self-hosted Nango runner still accepts executable JavaScript with authentication off by default.
Affects
Nango's self-hosted integration-automation runner, which executes customer integration code in Linux containers or Kubernetes pods.
The scope excludes Nango Cloud and runners isolated from untrusted peers.
Detail and 4 sources
Release 0.71.6 adds verification, but its authentication switch defaults to false, leaving an unchanged image deployment fail-open.
Sources
Code / PoCfix(runner): auth runner start by rossmcewan · Pull Request #7288 · NangoHQ/nango · GitHubCode / PoCRelease v0.71.6 · NangoHQ/nango · GitHubPatchfix(runner): auth runner start (#7288) · NangoHQ/nango@ed3030a · GitHubVendorNango < 0.71.6 Missing Authentication RCE via runner tRPC server | Advisories | VulnCheck