EUVD-2026-81064
GHSA-29mm-6vmq-g8cg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Nango tenant
-
DeliverySubmit crafted connection config values
-
ExploitValues interpolated into token/proxy URL template
-
ExecutionServer issues request to metadata/internal endpoint
-
ImpactExfiltrate cloud credentials or provider secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Nango account (PR:L) with the ability to supply connection configuration values that Nango interpolates into provider token URL or proxy URL templates (per the vulnerable interpolation logic in packages/shared/lib/utils/utils.ts through v0.70.4). No user interaction is needed. Exploitation is meaningfully amplified when Nango is deployed in a cloud environment with a reachable instance metadata service (e.g. AWS/GCP 169.254.169.254) or internal-only services on the server's network; deployments using IMDSv2, link-local egress filtering, or non-cloud hosting substantially limit the credential-theft payoff. The primary limiter is the authentication requirement - the attacker must already be a legitimate tenant/connection operator. |
| Impact | Genuine but moderate priority. The vendor CVSS 4.0 vector (7.1) is coherent with the description: AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:L/VA:N reflects a network-reachable, low-complexity SSRF that requires an authenticated caller (PR:L) and yields high confidentiality impact (provider credential exfiltration) with only minor integrity impact and no availability impact. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so this is best treated as no public exploit identified at time of analysis rather than an actively exploited flaw. The realistic risk is concentrated in cloud-hosted deployments where the SSRF can reach the instance metadata service (e.g. 169.254.169.254) or internal-only services; on-prem or metadata-hardened (IMDSv2/blocked link-local) deployments materially reduce impact. The authentication requirement (PR:L) and dependence on the attacker being a legitimate Nango tenant/connection operator are the main limiters keeping this out of the mass-exploitation tier. No signals conflict: description, CWE-918, and the vendor vector all agree the attack is authenticated SSRF with confidentiality-dominant impact. |
| Exploit ScenarioDerived | An authenticated Nango user creates or edits a connection and supplies malicious connection configuration values that are interpolated unvalidated into provider token or proxy URL templates. When Nango's server builds and sends the outbound request, it is redirected to an internal address or the cloud metadata endpoint, returning IAM credentials or internal service data and potentially leaking provider credentials. No public proof-of-concept exploit is identified in the provided data, and exploitation requires low but valid privileges (PR:L) with no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Server-side request forgery in Nango through version 0.70.4 lets an authenticated user steer server-side HTTP requests to attacker-chosen destinations by supplying malicious values in connection configuration fields that Nango interpolates into provider token and proxy URL templates. Successful abuse can reach internal-only services or cloud instance metadata endpoints (for example 169.254.169.254) and potentially exfiltrate provider credentials held by the Nango deployment. Authentication with the ability to supply connection configuration is required (CVSS 4.0 vector shows PR:L), no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - the practical risk is rated moderate because the primary limiter is the pre-existing authenticated access and the payoff depends heavily on the deployment's cloud/network egress posture.
RemediationAI
Vendor advisory: patch available per the GitHub Security Advisory at https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx - upgrade off any 0.70.4-or-earlier release to the fixed version named in that advisory (an exact fix version is not confirmed by the available data, so validate against the advisory before upgrading); VulnCheck's advisory https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration provides additional context. Until the upgrade is applied, the highest-value compensating controls are: enforce IMDSv2-only on the instance and block outbound traffic to 169.254.169.254 and other link-local ranges at the host or VPC egress layer (low operational cost, but may break unrelated tooling that still relies on IMDSv1); apply default-deny egress/allow-list filtering for the Nango host limited to the specific provider domains the instance actually needs (effectively neutralizes the SSRF but can break tenants using long-tail or dynamically resolved provider endpoints, so the list must be maintained); run Nango under a least-privilege instance role and scope stored provider credentials so that any exfiltrated token has minimal blast radius (reduces impact but does not stop the request forgery); and monitor/alert on server-side requests to private, loopback, and metadata addresses. Restricting which users or tenants may write raw connection configuration values reduces the attack surface but is not a complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nango is an open-source integration/API-connection platform that brokers OAuth and API credentials for many third-party providers. Root cause is CWE-918 (Server-Side Request Forgery): caller-supplied connection configuration values are interpolated into provider token URL and proxy URL templates without validation or allow-listing of the resulting destination, as reflected in the interpolation logic in packages/shared/lib/utils/utils.ts at tag v0.70.4. Because the request is issued by the Nango server rather than the client, the attacker can redirect it toward addresses reachable only from the server's network position - RFC1918 ranges, loopback, internal admin APIs, or the link-local cloud metadata service - and the response/credential material can be surfaced back through the integration flow. Per the independent assessment, the practical impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rather than the integrity impact implied by the supplied CVSS 4.0 vector; exploitation is amplified when the host runs in a cloud account with a reachable metadata endpoint (especially IMDSv1) or has internal services on the same network, while IMDSv2 enforcement, link-local egress filtering, or non-cloud hosting substantially reduces the credential-theft payoff. Exploitation is authenticated (PR:L) and requires no user interaction.
Know when Nango gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated (PR:L) network SSRF with no user interaction; confidentiality-high from credential/metadata exfiltration, with no integrity or availability impact and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
Technical POC Analysis
CWE-918 (SSRF), via template injection into provider URLs.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Nango, an integration platform used to broker OAuth connections and proxy API calls to dozens of third-party providers, contains a server-side request forgery flaw (CVE-2026-92804) affecting all releases through 0.70.4. Any user who can create or edit a connection configuration - including ordinary integration users in multi-tenant deployments - can redirect the platform's outbound HTTP traffic to attacker-chosen destinations, including cloud instance metadata endpoints, which could expose the provider credentials Nango holds on behalf of the entire organization. Because Nango is a trust broker for downstream SaaS credentials, a single authenticated abuse could cascade into compromise of many connected business systems, making this a priority for teams running self-hosted Nango in cloud environments with permissive egress.
No vendor-released patch identified at time of analysis. Interim mitigations: block outbound traffic from Nango hosts to link-local metadata endpoints (169.254.169.254) and internal-only address ranges; enforce IMDSv2 or disable cloud instance metadata; route egress through a domain-allowlisting proxy limited to sanctioned provider APIs; restrict connection-configuration create/edit permissions to the smallest possible set of trusted users; rotate provider credentials held by the deployment; and enable logging/alerting on anomalous outbound requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the run
An authorization bypass in Nango versions prior to 0.70.9 allows a same-team user with the development_full_access role
Exploit-DB