CVE-2026-92804

Published: Sep 16, 2026Modified: Sep 22, 2026Deferred

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/NangoHQ/nango

Source: disclosure@vulncheck.com

https://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.ts

Source: disclosure@vulncheck.com

https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration

Source: disclosure@vulncheck.com

https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.