Search
Find a vulnerability
Search criteria
6 vulnerabilities found for nango by NangoHQ
CVE-2026-102596 (GCVE-0-2026-102596)
Vulnerability from nvd – Published: 2026-10-12 21:58 – Updated: 2026-10-14 11:49
VLAI
EPSS
VEX
Title
Nango: Production flow RBAC bypass on private flow-read routes
Summary
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 11:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/security/advisor… | x_refsource_CONFIRM |
| https://github.com/NangoHQ/nango/pull/6603 | x_refsource_MISC |
| https://github.com/NangoHQ/nango/commit/3896f6abf… | x_refsource_MISC |
| https://github.com/NangoHQ/nango/releases/tag/man… | x_refsource_MISC |
| https://github.com/NangoHQ/nango/releases/tag/v0.70.9 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102596",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T11:47:57.376247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T11:49:26.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "nango",
"vendor": "NangoHQ",
"versions": [
{
"status": "affected",
"version": "\u003c 0.70.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: \u0027read\u0027, resource: \u0027flow\u0027, scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:58:26.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
},
{
"name": "https://github.com/NangoHQ/nango/pull/6603",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/pull/6603"
},
{
"name": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9"
},
{
"name": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
},
{
"name": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9"
}
],
"source": {
"advisory": "GHSA-vc5r-hj76-f35p",
"discovery": "UNKNOWN"
},
"title": "Nango: Production flow RBAC bypass on private flow-read routes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102596",
"datePublished": "2026-10-12T21:58:26.250Z",
"dateReserved": "2026-09-29T14:18:02.920Z",
"dateUpdated": "2026-10-14T11:49:26.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92804 (GCVE-0-2026-92804)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-21 14:52
VLAI
EPSS
VEX
Title
Nango through 0.70.4 Server-Side Request Forgery via Configuration
Summary
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/security/advisor… | third-party-advisoryvendor-advisory |
| https://github.com/NangoHQ/nango/blob/v0.70.4/pac… | technical-description |
| https://github.com/NangoHQ/nango | product |
| https://www.vulncheck.com/advisories/nango-throug… | third-party-advisory |
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92804",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:52:12.884019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:52:18.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/nango",
"product": "Nango",
"vendor": "NangoHQ",
"versions": [
{
"lessThanOrEqual": "0.70.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:53.949Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hgjm-c252-ccxx)",
"tags": [
"third-party-advisory",
"vendor-advisory"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx"
},
{
"name": "getConnectionConfig accepts any string value",
"tags": [
"technical-description"
],
"url": "https://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/NangoHQ/nango"
},
{
"name": "VulnCheck Advisory: Nango through 0.70.4 Server-Side Request Forgery via Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration"
}
],
"title": "Nango through 0.70.4 Server-Side Request Forgery via Configuration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92804",
"datePublished": "2026-09-16T20:32:53.949Z",
"dateReserved": "2026-09-16T19:47:14.535Z",
"dateUpdated": "2026-09-21T14:52:18.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9317 (GCVE-0-2026-9317)
Vulnerability from nvd – Published: 2026-09-04 17:56 – Updated: 2026-09-08 17:45 X_Open Source
VLAI
EPSS
VEX
Title
Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Summary
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:44 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/releases/tag/v0.71.6 | release-notes |
| https://github.com/NangoHQ/nango/pull/7288 | issue-trackingpatch |
| https://github.com/NangoHQ/nango/commit/ed3030a9a… | patch |
| https://www.vulncheck.com/advisories/nango-missin… | third-party-advisory |
Date Public
2026-09-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:44:57.731343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:45:11.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/NangoHQ/nango",
"product": "nango",
"repo": "https://github.com/NangoHQ/nango",
"vendor": "NangoHQ",
"versions": [
{
"lessThan": "0.71.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Katriel Moses"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T10:28:20.500Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "nango v0.71.6 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/v0.71.6"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/NangoHQ/nango/pull/7288"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Nango \u003c 0.71.6 Missing Authentication RCE via runner tRPC server",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-9317",
"datePublished": "2026-09-04T17:56:20.208Z",
"dateReserved": "2026-05-22T19:44:51.098Z",
"dateUpdated": "2026-09-08T17:45:11.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102596 (GCVE-0-2026-102596)
Vulnerability from cvelistv5 – Published: 2026-10-12 21:58 – Updated: 2026-10-14 11:49
VLAI
EPSS
VEX
Title
Nango: Production flow RBAC bypass on private flow-read routes
Summary
Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: 'read', resource: 'flow', scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 11:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/security/advisor… | x_refsource_CONFIRM |
| https://github.com/NangoHQ/nango/pull/6603 | x_refsource_MISC |
| https://github.com/NangoHQ/nango/commit/3896f6abf… | x_refsource_MISC |
| https://github.com/NangoHQ/nango/releases/tag/man… | x_refsource_MISC |
| https://github.com/NangoHQ/nango/releases/tag/v0.70.9 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102596",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T11:47:57.376247Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T11:49:26.276Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "nango",
"vendor": "NangoHQ",
"versions": [
{
"status": "affected",
"version": "\u003c 0.70.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth but omit can({ action: \u0027read\u0027, resource: \u0027flow\u0027, scopedBy: envScope }). A same-team user with the development_full_access role can therefore request env=prod and read production integration flow metadata or named flow configuration despite being denied by guarded production routes. Both controllers use res.locals.environment from the authenticated account, so the issue bypasses the production role boundary but does not cross tenant boundaries. This issue is fixed in version 0.70.9 and managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:58:26.250Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-vc5r-hj76-f35p"
},
{
"name": "https://github.com/NangoHQ/nango/pull/6603",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/pull/6603"
},
{
"name": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/commit/3896f6abf71408b8966da1ea4afb1885647403c9"
},
{
"name": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/managed-1.5.11-0.70.8-aae30d044d7e229807d51a3957c212f3fb689e1a"
},
{
"name": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/v0.70.9"
}
],
"source": {
"advisory": "GHSA-vc5r-hj76-f35p",
"discovery": "UNKNOWN"
},
"title": "Nango: Production flow RBAC bypass on private flow-read routes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102596",
"datePublished": "2026-10-12T21:58:26.250Z",
"dateReserved": "2026-09-29T14:18:02.920Z",
"dateUpdated": "2026-10-14T11:49:26.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92804 (GCVE-0-2026-92804)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-21 14:52
VLAI
EPSS
VEX
Title
Nango through 0.70.4 Server-Side Request Forgery via Configuration
Summary
Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/security/advisor… | third-party-advisoryvendor-advisory |
| https://github.com/NangoHQ/nango/blob/v0.70.4/pac… | technical-description |
| https://github.com/NangoHQ/nango | product |
| https://www.vulncheck.com/advisories/nango-throug… | third-party-advisory |
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92804",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:52:12.884019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:52:18.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/nango",
"product": "Nango",
"vendor": "NangoHQ",
"versions": [
{
"lessThanOrEqual": "0.70.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:53.949Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hgjm-c252-ccxx)",
"tags": [
"third-party-advisory",
"vendor-advisory"
],
"url": "https://github.com/NangoHQ/nango/security/advisories/GHSA-hgjm-c252-ccxx"
},
{
"name": "getConnectionConfig accepts any string value",
"tags": [
"technical-description"
],
"url": "https://github.com/NangoHQ/nango/blob/v0.70.4/packages/shared/lib/utils/utils.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/NangoHQ/nango"
},
{
"name": "VulnCheck Advisory: Nango through 0.70.4 Server-Side Request Forgery via Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nango-through-0.70.4-server-side-request-forgery-via-configuration"
}
],
"title": "Nango through 0.70.4 Server-Side Request Forgery via Configuration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92804",
"datePublished": "2026-09-16T20:32:53.949Z",
"dateReserved": "2026-09-16T19:47:14.535Z",
"dateUpdated": "2026-09-21T14:52:18.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9317 (GCVE-0-2026-9317)
Vulnerability from cvelistv5 – Published: 2026-09-04 17:56 – Updated: 2026-09-08 17:45 X_Open Source
VLAI
EPSS
VEX
Title
Nango < 0.71.6 Missing Authentication RCE via runner tRPC server
Summary
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:44 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/NangoHQ/nango/releases/tag/v0.71.6 | release-notes |
| https://github.com/NangoHQ/nango/pull/7288 | issue-trackingpatch |
| https://github.com/NangoHQ/nango/commit/ed3030a9a… | patch |
| https://www.vulncheck.com/advisories/nango-missin… | third-party-advisory |
Date Public
2026-09-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:44:57.731343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:45:11.577Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/NangoHQ/nango",
"product": "nango",
"repo": "https://github.com/NangoHQ/nango",
"vendor": "NangoHQ",
"versions": [
{
"lessThan": "0.71.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Katriel Moses"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T10:28:20.500Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "nango v0.71.6 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/NangoHQ/nango/releases/tag/v0.71.6"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/NangoHQ/nango/pull/7288"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/NangoHQ/nango/commit/ed3030a9a0f8e4f3810fd10cb3a1905a2f5f87d2"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nango-missing-authentication-rce-via-runner-trpc-server"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Nango \u003c 0.71.6 Missing Authentication RCE via runner tRPC server",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-9317",
"datePublished": "2026-09-04T17:56:20.208Z",
"dateReserved": "2026-05-22T19:44:51.098Z",
"dateUpdated": "2026-09-08T17:45:11.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}