Nango
Monthly
Server-side request forgery in Nango through version 0.70.4 lets an authenticated user steer server-side HTTP requests to attacker-chosen destinations by supplying malicious values in connection configuration fields that Nango interpolates into provider token and proxy URL templates. Successful abuse can reach internal-only services or cloud instance metadata endpoints (for example 169.254.169.254) and potentially exfiltrate provider credentials held by the Nango deployment. Authentication with the ability to supply connection configuration is required (CVSS 4.0 vector shows PR:L), no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - the practical risk is rated moderate because the primary limiter is the pre-existing authenticated access and the payoff depends heavily on the deployment's cloud/network egress posture.
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the runner process by invoking the runner tRPC server's exposed 'start' procedure. The runner fails to enforce the RUNNER_SECRET_KEY environment variable, so any actor with network reach to the runner port can trigger code execution. Reported by VulnCheck; a vendor patch is available (v0.71.6) and publicly available exploit code exists via the VulnCheck advisory, though it is not listed in CISA KEV.
An authorization bypass in Nango versions prior to 0.70.9 allows a same-team user with the development_full_access role to read production integration flow metadata and named flow configuration when RBAC is enabled (has_rbac=true). This occurs because two private flow-read routes-GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName-omit the can({ action: 'read', resource: 'flow', scopedBy: envScope }) guard, enabling access to env=prod despite production role boundaries. The flaw is fixed in version 0.70.9; no public exploit code or active exploitation is currently identified, and the CVSS score is 4.3 (low severity).
Server-side request forgery in Nango through version 0.70.4 lets an authenticated user steer server-side HTTP requests to attacker-chosen destinations by supplying malicious values in connection configuration fields that Nango interpolates into provider token and proxy URL templates. Successful abuse can reach internal-only services or cloud instance metadata endpoints (for example 169.254.169.254) and potentially exfiltrate provider credentials held by the Nango deployment. Authentication with the ability to supply connection configuration is required (CVSS 4.0 vector shows PR:L), no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) - the practical risk is rated moderate because the primary limiter is the pre-existing authenticated access and the payoff depends heavily on the deployment's cloud/network egress posture.
Remote code execution in Nango before 0.71.6 allows unauthenticated attackers to run arbitrary JavaScript inside the runner process by invoking the runner tRPC server's exposed 'start' procedure. The runner fails to enforce the RUNNER_SECRET_KEY environment variable, so any actor with network reach to the runner port can trigger code execution. Reported by VulnCheck; a vendor patch is available (v0.71.6) and publicly available exploit code exists via the VulnCheck advisory, though it is not listed in CISA KEV.
An authorization bypass in Nango versions prior to 0.70.9 allows a same-team user with the development_full_access role to read production integration flow metadata and named flow configuration when RBAC is enabled (has_rbac=true). This occurs because two private flow-read routes-GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName-omit the can({ action: 'read', resource: 'flow', scopedBy: envScope }) guard, enabling access to env=prod despite production role boundaries. The flaw is fixed in version 0.70.9; no public exploit code or active exploitation is currently identified, and the CVSS score is 4.3 (low severity).