rootpwn

high · CVSS v3 7.1 · CVSS v4 7.1

CVE-2026-92804

Nango 0.70.4 does not validate user‑supplied configuration values that are interpolated into provider token and proxy URL templates. An auth

Overview

Nango 0.70.4 does not validate user‑supplied configuration values that are interpolated into provider token and proxy URL templates. An authenticated attacker can inject malicious values to force the server to send requests to internal or cloud metadata endpoints, potentially leaking provider credentials.

Description

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.

Impact

Authenticated users can cause the Nango server to reach internal network addresses or cloud metadata services, exposing sensitive provider credentials. This leads to confidentiality loss of credential data and could enable further lateral movement or privilege escalation.

Remediation

['Upgrade to the latest Nango release (≥\u202f0.70.5) where input validation for template values has been added.', 'If an upgrade is not immediately possible, restrict the Nango service’s outbound network access to only approved endpoints and block connections to internal IP ranges and cloud metadata URLs.', 'Implement strict input validation or sanitization for all configuration fields that are used in URL or token templates.', 'Apply least‑privilege access controls so that only trusted users can modify provider configurations.']

Risk context

High severity (CVSS 7.1). No EPSS data available. The vulnerability can be exploited by authenticated users, making it a significant risk for environments where Nango is exposed to privileged personnel.

Affected products

  • Nango 0.70.4

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.1
CVSS v4
7.1
EPSS
—

configuration template-injection credential-exfiltration internal-attack Nango high

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis