CVE-2026-92804highCWE-918

CVE-2026-92804: high-severity vulnerability in NangoHQ Nango

Nango through 0.70.4 Server-Side Request Forgery via Configuration

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
NangoHQ · Nango
References
https://github.com/NangoHQ/nangohttps://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.tshttps://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxxhttps://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration