Threat database

NangoHQ nango versions prior to 0.70.9 contain a missing authorization vulnerability (CWE-862) in two private flow-read API routes. On accounts with RBAC enabled, users with the development_full_access role can bypass production role boundaries within the same tenant and read production integration flow metadata or named flow configurations. This issue does not allow cross-tenant access. The vulnerability is fixed in version 0.70.9.

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials.

Nango versions before 0.71.6 have a critical missing authentication vulnerability in the runner tRPC server. This flaw allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials, bypassing the RUNNER_SECRET_KEY environment variable. This leads to remote code execution within the runner process.