Nango versions up to 0.70.4 do not validate caller-supplied connection configuration values used in provider token and proxy URL templates. This allows authenticated attackers to craft malicious configuration inputs that cause the server to perform SSRF attacks targeting internal addresses or cloud metadata endpoints. Such SSRF can potentially expose sensitive provider credentials stored or accessible via these internal endpoints.

An authenticated attacker can leverage this SSRF vulnerability to direct server requests to internal network resources or cloud metadata services. This may result in unauthorized disclosure of sensitive provider credentials, which could be used for further attacks or unauthorized access. The CVSS 4.0 score of 7.1 (high severity) reflects the significant impact due to credential exposure and the low complexity of attack with low privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Nango versions and monitor for suspicious configuration changes. Avoid exposing Nango instances to untrusted users and consider network-level controls to limit server access to internal or cloud metadata endpoints.