CVE-2026-92804

EUVD-2026-81064
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/NangoHQ/nango
https://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.ts
https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx
https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration