CVE-2026-92804

Nango through version 0.70.4 fails to validate caller-supplied connection configuration values that are interpolated into provider token endpoints and proxy URL templates, resulting in server-side request forgery (CWE-918). An authenticated attacker with low-privileged access can submit crafted configuration values that cause the Nango server to send requests to attacker-chosen internal addresses or cloud metadata endpoints. Successful abuse can leak internal service responses and potentially exfiltrate stored provider credentials such as OAuth tokens. Any deployment running Nango version 0.70.4 or earlier is affected, with self-hosted instances bearing the greatest risk. No public proof-of-concept is known, the flaw is not in CISA KEV, and exploitation has not been observed.

What to do: Upgrade Nango to a release newer than 0.70.4 once a patched version is available, and audit existing connection configurations for unexpected hostnames or URLs. Restrict which API credentials can create or modify connections and apply egress filtering on the Nango server, particularly blocking link-local cloud metadata addresses such as 169.254.169.254. Rotate stored provider credentials if suspicious connection configs or unexplained outbound requests are found.