CVE-2026-92804

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-92804

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92804.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-92804

Aliases

GHSA-hgjm-c252-ccxx

Published

2026-09-16T20:32:53Z

Modified

2026-09-18T03:49:14Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Nango through 0.70.4 Server-Side Request Forgery via Configuration

Details

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92804.json"
}

References

Affected packages

Git / github.com/nangohq/nango

Affected ranges

Type

GIT

Repo

https://github.com/nangohq/nango

Events

Introduced

Fixed

434bbdb778d83d9f9b64e8d4b295f2bbb6c16279

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.70.4"
        },
        {
            "fixed": "0.70.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*

0.13.0

0.25.6

managed-1.*

managed-1.4.10-0.69.26-f6621ee4cae9d1cdd7ed4c4c73bbbe9ef7c7a7b1

managed-1.4.11-0.69.31-8b281d6cc88e062f01f8d10040b4bda928443ae4

managed-1.4.12-0.69.38-55b35c6a10aa6d08ec4fd16532cf30125dee7977

managed-1.4.13-0.69.38-ab8b203d6316643fd1e3e7aafce567d2b29a988e

managed-1.4.14-0.69.46-e4b7a312a5f20fd23a1932c0e5e41f9ae8fe0ec7

managed-1.4.15-0.69.48-7bdd3e5684ad84dc74922c40c516528c7ff33ae4

managed-1.4.7-0.69.21-089856699158d3d8466bf938aed2f8eb93a0c2a3

managed-1.4.8-0.69.22-da96e83743a3e9d7165d09f7901dd58b52dbfbbf

managed-1.4.9-0.69.22-4fc73b2775cc1e5554d03de5c5320ba651d8e478

managed-1.5.0-0.70.0-2724cf5b6dab04a7040919dc1e693ff08c84d4e3

managed-1.5.1-0.70.1-5e931ac80c6e6adbf14149249f00c4d068fd0a64

managed-1.5.2-0.70.1-fd331f09bfdff10d6fb7c1c292c9a56fbebf44ef

managed-1.5.3-0.70.3-8ad36940476ad129a6450dd152636498d4d2285f

v0.*

v0.10.1

v0.10.2

v0.10.4

v0.10.7

v0.11.2

v0.11.3

v0.12.1

v0.12.3

v0.12.4

v0.12.6

v0.12.7

v0.13.4

v0.13.5

v0.14.0

v0.15.1

v0.16.0

v0.2.1

v0.2.2

v0.24.4

v0.24.5

v0.25.6

v0.26.1

v0.27.0

v0.28.1

v0.29.0

v0.3.6

v0.3.7

v0.31.5

v0.32.8

v0.33.0

v0.35.5

v0.36.14

v0.37.0

v0.37.1

v0.37.10

v0.37.11

v0.37.12

v0.37.13

v0.37.14

v0.37.15

v0.37.16

v0.37.17

v0.37.18

v0.37.19

v0.37.2

v0.37.20

v0.37.21

v0.37.22

v0.37.23

v0.37.24

v0.37.25

v0.37.26

v0.37.3

v0.37.4

v0.37.5

v0.37.6

v0.37.7

v0.37.8

v0.37.9

v0.38.0

v0.38.1

v0.38.3

v0.38.4

v0.38.5

v0.39.0

v0.39.1

v0.39.13

v0.39.14

v0.39.15

v0.39.16

v0.39.17

v0.39.18

v0.39.19

v0.39.2

v0.39.20

v0.39.21

v0.39.22

v0.39.23

v0.39.24

v0.39.25

v0.39.26

v0.39.27

v0.39.28

v0.39.29

v0.39.3

v0.39.30

v0.39.31

v0.39.32

v0.39.33

v0.39.4

v0.39.5

v0.39.6

v0.39.7

v0.39.8

v0.4.0

v0.40.0

v0.40.1

v0.40.10

v0.40.2

v0.40.3

v0.40.4

v0.40.5

v0.40.6

v0.40.7

v0.40.8

v0.40.9

v0.41.0

v0.41.1

v0.42.0

v0.42.10

v0.42.12

v0.42.15

v0.42.17

v0.42.18

v0.42.19

v0.42.2

v0.42.20

v0.42.21

v0.42.22

v0.42.4

v0.42.5

v0.42.6

v0.42.7

v0.42.8

v0.42.9

v0.43.0

v0.44.0

v0.45.0

v0.45.1

v0.46.0

v0.46.1

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.48.3

v0.48.4

v0.49.0

v0.5.0

v0.5.1

v0.5.2

v0.50.0

v0.51.0

v0.52.1

v0.52.2

v0.52.3

v0.52.4

v0.52.5

v0.53.0

v0.53.1

v0.53.2

v0.54.0

v0.55.0

v0.56.0

v0.56.1

v0.56.2

v0.56.3

v0.56.4

v0.57.0

v0.57.1

v0.57.2

v0.57.3

v0.57.4

v0.57.5

v0.57.6

v0.58.1

v0.58.2

v0.58.3

v0.58.4

v0.58.5

v0.58.6

v0.58.7

v0.59.0

v0.59.1

v0.59.11

v0.59.12

v0.59.13

v0.59.3

v0.59.7

v0.59.8

v0.60.0

v0.60.1

v0.60.2

v0.60.3

v0.60.4

v0.60.5

v0.61.0

v0.61.1

v0.61.2

v0.61.3

v0.62.0

v0.62.1

v0.63.0

v0.63.1

v0.64.0

v0.64.1

v0.64.2

v0.64.3

v0.64.4

v0.65.0

v0.66.0

v0.66.1

v0.66.2

v0.67.0

v0.67.1

v0.67.2

v0.67.3

v0.67.4

v0.67.5

v0.67.6

v0.67.7

v0.67.8

v0.68.0

v0.69.0

v0.69.1

v0.69.10

v0.69.12

v0.69.13

v0.69.14

v0.69.15

v0.69.16

v0.69.17

v0.69.18

v0.69.19

v0.69.2

v0.69.20

v0.69.21

v0.69.22

v0.69.26

v0.69.27

v0.69.28

v0.69.29

v0.69.3

v0.69.30

v0.69.31

v0.69.32

v0.69.33

v0.69.34

v0.69.35

v0.69.36

v0.69.38

v0.69.39

v0.69.4

v0.69.40

v0.69.41

v0.69.42

v0.69.43

v0.69.44

v0.69.45

v0.69.46

v0.69.47

v0.69.48

v0.69.49

v0.69.5

v0.69.50

v0.69.6

v0.69.7

v0.69.8

v0.69.9

v0.7

v0.7.2

v0.70.0

v0.70.1

v0.70.2

v0.70.3

v0.8.0

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.9.0

v0.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92804.json"