NangoHQ

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

NangoHQ records in CISA KEV

No NangoHQ vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-62543 CVE-2026-92804 · GHSA-29mm-6vmq-g8cg

Nango through 0.70.4 Server-Side Request Forgery via Configuration

MEDIUM 64

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00369 Published 2026-09-16 No fix listed CWE-918

TI-2026-71347 CVE-2026-102596

Missing RBAC check on Nango flow-read routes exposes production flows

MEDIUM 53

Nango is an open-source platform for connecting agents and products to third-party APIs.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00293 Published 2026-10-12 Fixed in 0.70.9 CWE-862

TI-2026-08178 CVE-2026-9317 · GHSA-9cph-w8mv-q56r

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

MEDIUM 44

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without cre…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01264 Published 2026-09-04 Fixed in 0.71.6 CWE-306

Open these records in search →

Critical	1
High	1
Medium	1
Low	0
No CVSS	0