CVE-2026-92804 Overview
CVE-2026-92804 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Nango through version 0.70.4. The flaw resides in how Nango handles caller-supplied connection configuration values that are interpolated into provider token endpoints and proxy URL templates. Authenticated attackers can inject malicious configuration values to redirect server-side requests toward internal network addresses or cloud metadata endpoints. Successful exploitation can expose provider credentials and other sensitive data reachable from the Nango server. The vulnerability carries a CVSS 4.0 score of 7.1.
Critical Impact
Authenticated attackers can coerce the Nango server into issuing requests to internal services or cloud instance metadata endpoints, exfiltrating provider credentials.
Affected Products
- Nango versions through 0.70.4
- Deployments referencing utility logic in packages/shared/lib/utils/utils.ts
- Self-hosted and managed Nango instances that accept caller-supplied connection configuration
Discovery Timeline
- 2026-09-16 - CVE-2026-92804 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92804
Vulnerability Analysis
Nango is an open source product used to synchronize data with third-party APIs through configurable OAuth and proxy connectors. Provider integrations rely on URL templates that reference connection configuration values supplied by API callers. Nango through 0.70.4 interpolates those values into provider token URLs and proxy URLs without validating that the resulting request targets a legitimate provider endpoint. An authenticated attacker who can create or modify a connection can substitute values that rewrite the target host. The server then dispatches outbound requests to attacker-chosen destinations while carrying the provider credentials associated with the integration.
Root Cause
The root cause is missing validation of caller-controlled inputs used in URL template expansion. Utility helpers in packages/shared/lib/utils/utils.ts construct final request URLs by substituting configuration fields into templated strings. No allowlist enforces that the resolved host matches the expected provider domain. The result is classic SSRF via template interpolation, cataloged as [CWE-918].
Attack Vector
Exploitation requires network access to the Nango API and valid credentials with permission to configure a connection. The attacker supplies configuration values that redirect the interpolated URL toward an internal IP range, loopback address, or a cloud metadata service such as 169.254.169.254. When Nango issues the token exchange or proxy request, it forwards provider secrets or receives responses from the internal service. See the VulnCheck advisory and GitHub Security Advisory GHSA-hgjm-c252-ccxx for reference material.
No verified proof-of-concept code has been published. Technical review can be performed against the NangoHQ utility functions source.
Detection Methods for CVE-2026-92804
Indicators of Compromise
- Outbound HTTP requests from the Nango server to RFC1918 ranges, loopback, or link-local addresses such as 169.254.169.254
- Connection configuration entries containing IP literals, unusual hostnames, or URL fragments in fields expected to hold plain identifiers
- Provider token exchange responses containing cloud metadata payloads or JSON structures unrelated to the configured provider
Detection Strategies
- Log and review the resolved destination host for every outbound provider request and alert when it does not match the provider's expected domain allowlist
- Compare newly created or modified connection configurations against a baseline of legitimate field formats and flag entries that include protocol schemes or hostnames
- Correlate authenticated API activity that creates connections with immediate outbound requests to internal or metadata endpoints
Monitoring Recommendations
- Instrument the Nango host with egress network telemetry to detect traffic destined for internal ranges or cloud metadata services
- Forward Nango application logs to a centralized analytics platform and build queries for anomalous provider URL resolution
- Track authentication events on the Nango API and flag accounts that repeatedly write to connection configuration endpoints
How to Mitigate CVE-2026-92804
Immediate Actions Required
- Upgrade Nango to a release later than 0.70.4 once the vendor publishes a fixed version, tracked in GHSA-hgjm-c252-ccxx
- Restrict who can create or modify connection configurations to a minimal set of trusted operators
- Rotate provider credentials stored in Nango if unexpected outbound requests are found in logs
Patch Information
Monitor the NangoHQ GitHub repository and the GitHub Security Advisory GHSA-hgjm-c252-ccxx for the fixed release. The advisory identifies 0.70.4 as the last affected version. Apply the vendor patch as soon as it becomes available and validate that provider URL templates enforce host allowlisting after the update.
Workarounds
- Place the Nango server behind an egress proxy that blocks traffic to RFC1918, loopback, and cloud metadata addresses
- On AWS, enforce IMDSv2 with a hop limit of 1 so that Nango cannot retrieve instance credentials through the metadata service
- Segment the Nango deployment so it cannot reach sensitive internal services beyond the third-party APIs it is designed to call
- Add a request-side allowlist that validates the final resolved host against the expected provider domain before dispatch
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.