CVE-2026-92804 Details
Description
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
A server-side request forgery (SSRF) vulnerability has been identified in Nango versions through 0.70.4. The issue arises because the application fails to properly validate user-supplied connection configuration values that are interpolated into provider token and proxy URL templates. This lack of validation allows authenticated attackers to direct server requests to internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials. The vulnerability affects over 40 different providers within Nango.
To address this vulnerability, Nango should implement validation for 'connectionConfig' values after URL interpolation, rejecting any URLs that resolve to private, loopback, or link-local addresses. Additionally, a blocking HTTP agent should be used at the socket level for token exchange and proxy requests to prevent access to internal services or cloud metadata endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NangoHQ/nango | [email protected] | Vendor |
| https://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.ts | [email protected] | Source CodeVendor |
| https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NangoHQ Nango | <= 0.70.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |