Executive brief
Nango is an integration platform that connects applications to third-party APIs using configured credentials. Authenticated users can inject malicious configuration values that get interpolated into internal URLs, causing the Nango server to make requests to internal services or cloud metadata endpoints. This could allow attackers to steal provider credentials or access restricted internal resources.
Technical details
Nango through version 0.70.4 fails to validate user-supplied connection configuration values before interpolating them into provider token and proxy URL templates, creating a server-side request forgery (SSRF) vulnerability. The vulnerable component is in the URL template interpolation logic (packages/shared/lib/utils/utils.ts). An authenticated attacker can supply crafted configuration values containing internal IP addresses or cloud metadata endpoints (e.g., 169.254.169.254) that get substituted into URLs, causing the server to make requests to unintended targets. This allows exfiltration of provider credentials or enumeration of internal services. A patch addressing input validation is expected in versions after 0.70.4.
Affected products
- Nango Nango through 0.70.4
Timeline
- 2026-09-16: disclosed